GeoDirectory EUVD-2026-109223

Requires an authenticated account with Subscriber-level access or above on the target GeoDirectory site; where open user registration is enabled, an attacker can self-provision this access. Exploitation occurs through the plugin's listing-save workflow, where a user-controlled attachment reference is accepted without verifying that the attachment belongs to the listing being saved. Limiting factors: PR:L means it is not remotely exploitable by fully unauthenticated attackers; no user interaction is needed (UI:N); and the impact is confined to integrity of image metadata (title, caption, moderation status, featured flag) with no confidentiality or availability consequences, so it cannot be used to read data or take over the site.

This is a genuine but low-severity authorization flaw (CWE-639, IDOR) whose signals are internally consistent and point to low real-world priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N = 4.3) indicates a network-reachable, low-complexity attack requiring low privileges (PR:L), with only limited integrity impact and no confidentiality or availability impact - consistent with the description, which limits the attacker to modifying image metadata (title, caption, moderation status, featured flag) and claiming another user's image. EPSS reinforces low urgency at 0.18% (7th percentile), and the vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation. The PoC is a reference only and not verified as working exploit code, so it should not be treated as a weaponized exploit. The vendor priority label is 'this_month' rather than act_now or emergency. These signals do not conflict: a low-CVSS, low-EPSS, non-KEV authorization bug affecting only image metadata is a patch-in-routine-cycle issue, not a drop-everything emergency. The main caveat is that exploitation requires an authenticated Subscriber-level (or higher) account, which the CVSS PR:L correctly reflects.

An attacker who holds (or self-registers for) a Subscriber-level account on a GeoDirectory-powered site saves a listing while referencing an attachment ID that belongs to another user's listing; because the plugin never verifies ownership of the referenced attachment, the attacker alters that image's title, caption, moderation status, or featured flag, or claims it as their own featured image. A public PoC reference exists via WPScan but is not verified as working exploit code, and the attack requires a valid low-privileged account.