GeoDirectory CVE-2026-84813

Exploitation requires only network reachability to a WordPress site running GeoDirectory <= 2.8.174 with the vulnerable directory/listing feature exposed to anonymous users; per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are needed against a default installation. Limiting factors: the site must actually run an affected GeoDirectory version and expose the injectable endpoint, and a front-end WAF or virtual patch would blunt generic SQLi payloads. The exact injectable parameter is not disclosed in the provided data.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, 9.3) describes an easy, remote, unauthenticated read-primarily attack; the elevated score depends heavily on the S:C scope change (treating the database as a separate authority) - with the more common S:U for plugin SQLi the base score falls to roughly 7.5. Note the vendor set I:N and only A:L, which is consistent with a read-oriented (extraction) rather than data-modifying injection. No EPSS score, no CISA KEV listing, and no public PoC are present in the input, so there is no evidence of active exploitation; however, unauthenticated WordPress-plugin SQLi historically attracts opportunistic mass-scanning once a PoC surfaces, so this should be treated as a high-priority patch item despite the current absence of exploitation signals. The single-source (Patchstack-only) reporting means exact injectable parameter and affected endpoint are not independently confirmed here.

An unauthenticated attacker sends a crafted HTTP request to a GeoDirectory search or listing endpoint with a malicious value in the injectable parameter, causing the plugin to run attacker-controlled SQL. Using boolean/UNION or time-based techniques they enumerate and dump the wp_users table (password hashes, emails) and other sensitive records. No public exploit code is identified yet, but the low complexity and no-auth requirement make weaponization straightforward once a PoC is published.