GeoDirectory CVE-2026-57681

Exploitation requires a valid WordPress subscriber account on the target site - the lowest registered-user role. If the site permits open user registration (a common configuration for directory and listing platforms that GeoDirectory targets), any internet user can self-register and immediately exploit this vulnerability. Sites that disable public registration or restrict registration to trusted users significantly reduce exposure. No additional plugin features, non-default configurations, or specific deployment modes are confirmed as required beyond having subscriber access. Impact scope extends to internal network resources the server can reach; the severity is highest in cloud-hosted environments where instance metadata endpoints are accessible.

The NVD CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) accurately reflects a medium-severity but meaningful risk. The low attack complexity and absence of user interaction make exploitation straightforward for any authenticated subscriber. The Scope:Changed vector elevates real-world impact beyond the raw score suggests: in cloud-hosted environments, SSRF commonly enables AWS/GCP/Azure instance metadata access, potentially leaking IAM credentials and escalating to full account compromise - an impact not captured in the C:L/I:L CVSS impact ratings alone. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. However, WordPress plugins are heavily targeted by automated scanners, and the low privilege requirement (subscriber) makes this accessible to any user who can register on the site. Risk is meaningfully higher on sites with open user registration enabled.

A registered subscriber on a GeoDirectory-powered business listing site submits a crafted request containing an internal URL (e.g., http://169.254.169.254/latest/meta-data/ on AWS) to the vulnerable plugin endpoint. The server fetches the URL and returns cloud instance metadata, including IAM role credentials, to the attacker. No public proof-of-concept code has been identified at time of analysis, but the low complexity and subscriber-only requirement make independent exploitation straightforward for any attacker with site registration access.