GeoDirectory CVE-2026-66604

The vulnerability requires no account, credentials, or special configuration by the attacker - CVSS PR:N confirms unauthenticated exploitation. The necessary and sole limiting condition is victim interaction (UI:R): a user, ideally an authenticated WordPress administrator, must load the page or content item containing the injected payload in their browser. No non-default plugin configuration, specific deployment mode, or co-installed component is described as required in the available data, indicating this affects standard GeoDirectory installations in their default state. What limits exploitation in practice is the need to socially engineer a victim into viewing the malicious content, or to rely on organic site traffic to the affected listing - neither of which is a strong technical barrier for a motivated attacker targeting high-traffic directory sites.

The CVSS 3.1 base score of 7.1 reflects a meaningful threat profile: network-reachable (AV:N), low attack complexity (AC:L), and no authentication required (PR:N) together mean any internet-accessible actor can attempt injection with minimal tooling. The mandatory user interaction (UI:R) is the primary limiting factor - exploitation requires a victim to load the page containing the payload, which in practice is straightforward to achieve via phishing links or by targeting high-traffic listing pages. The scope-changed metric (S:C) elevates the practical impact beyond what the individual C:L/I:L/A:L ratings suggest, since a compromised admin session enables full WordPress site takeover. EPSS data is absent from available intelligence, so precise exploitation probability cannot be stated; the KEV registry does not list this CVE, indicating no confirmed active exploitation campaign at time of analysis. The combination of unauthenticated injection and a WordPress plugin context - where administrators regularly review public-submitted content - represents a realistic and common attack path that security teams should not underweight based on the moderate per-metric impact ratings alone.

An unauthenticated attacker submits a crafted directory listing or form input containing a JavaScript payload to a public-facing GeoDirectory endpoint. When an authenticated WordPress administrator reviews the listing or navigates to the affected page - a routine administrative task - the injected script executes in the admin's browser session, enabling the attacker to exfiltrate the admin's session cookie, create a rogue administrator account, or install a malicious plugin via the WordPress admin API. No public proof-of-concept exploit has been identified at time of analysis, but the low complexity and unauthenticated nature make manual exploitation straightforward with standard browser developer tools.