GeoDirectory EUVD-2026-36951

No special conditions - remote unauthenticated exploitation against default configurations of the GeoDirectory WordPress plugin at versions ≤2.8.152 (CVSS AV:N/AC:L/PR:N/UI:N). The only prerequisite is that the plugin is installed and activated on a reachable WordPress site, and that the vulnerable front-end endpoint (search/listing/AJAX handler) is exposed to the attacker - which is the default for any public WordPress site using GeoDirectory for its intended business-directory purpose. Limiting factors: sites that have already updated above 2.8.152, sites that gate GeoDirectory pages behind authentication or membership plugins, and sites with a tuned WAF blocking SQLi signatures will see reduced exposure.

Risk is high in aggregate: CVSS 9.3 reflects AV:N/AC:L/PR:N/UI:N (remote, low complexity, no auth, no user interaction) with a Scope change (S:C) indicating the injection can read data beyond the vulnerable component's privilege boundary, and impact metrics show C:H (full database confidentiality compromise - credentials hashes, user PII, session tokens), I:N (no direct integrity impact claimed), and A:L (limited availability impact from heavy queries or locks). EPSS exploitation probability is not provided in the input, and the CVE is not in CISA KEV, so exploitation status is currently no public exploit identified at time of analysis. The mismatch worth flagging: I:N is unusual for SQLi since UNION-based or stacked queries often allow writes, so the NVD-style scoring may understate integrity risk - defenders should not assume read-only impact. WordPress plugin SQLi at this scope is historically a high-priority class because mass-scanning and automated exploitation kits typically follow Patchstack disclosures within days.

An unauthenticated attacker scans WordPress sites for the GeoDirectory plugin (fingerprintable via /wp-content/plugins/geodirectory/ asset paths), then sends a crafted HTTP request to a vulnerable directory search or listing endpoint with malicious SQL injected into a query parameter, executing a UNION-based extraction of wp_users credentials and session tokens. The attacker then cracks or replays an administrator session to pivot into full WordPress site takeover via the plugin/theme editor or PHP file upload. No POC is referenced in the provided data, but the SQLi class is trivially exploitable with sqlmap once the injection point is identified.