What is the CVSS score of CVE-2026-57681?

CVE-2026-57681 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

GeoDirectory CVE-2026-57681

EUVD-2026-41290 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-02 Patchstack

GHSA-24p8-c5jg-969r

WordPress SSRF Geodirectory Wordpress Plugin Paolo

6.4

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

PR:L reflects mandatory subscriber authentication; S:C captures SSRF reaching systems beyond the WordPress app; no availability impact identified.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:34 vuln.today

DescriptionCVE.org

Subscriber Server Side Request Forgery (SSRF) in GeoDirectory <= 2.8.161 versions.

AnalysisAI

Server-Side Request Forgery (SSRF) in the GeoDirectory WordPress plugin (versions 2.8.161 and earlier) allows authenticated subscribers to force the server to issue arbitrary internal or external HTTP requests. Because the vulnerability is accessible at the lowest WordPress registered-user privilege level (subscriber), any registered site user can trigger it without elevated permissions. No public exploit or CISA KEV entry has been identified at time of analysis, but the Scope:Changed CVSS rating confirms the impact extends beyond the WordPress application itself to backend infrastructure reachable from the server.

Technical ContextAI

GeoDirectory (CPE: cpe:2.3:a:paolo:geodirectory:*:*:*:*:*:*:*:*) is a WordPress plugin for building business directory and listing sites. The root cause is CWE-918 (Server-Side Request Forgery): the plugin accepts a user-supplied URL or endpoint parameter and uses it to initiate a server-side HTTP request without adequately validating or restricting the target. This allows the plugin's server process to reach internal network resources (e.g., cloud metadata endpoints such as 169.254.169.254, internal APIs, localhost services) that are otherwise firewalled from external clients. The CVSS Scope:Changed (S:C) metric reflects exactly this: exploitation affects systems outside the vulnerable WordPress application boundary.

RemediationAI

Update the GeoDirectory plugin to a version above 2.8.161; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/geodirectory/vulnerability/wordpress-geodirectory-plugin-2-8-161-server-side-request-forgery-ssrf-vulnerability?_s_id=cve should be consulted for the exact patched release version, which was not independently confirmed in the available data. As an immediate compensating control, disable open user registration on WordPress sites where it is not required (Settings > General > uncheck 'Anyone can register'), which eliminates the subscriber-level attack surface entirely - though this may prevent legitimate user signups. Firewall or metadata service blocking (e.g., blocking access to 169.254.169.254 at the host or cloud security group level) limits the impact of any successful SSRF by denying access to cloud instance metadata endpoints. Web Application Firewalls configured with SSRF-pattern rules can provide additional detection, though bypass risk exists.