EUVD-2026-36951
GHSA-5cfj-2j7j-f96c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network-reachable SQLi gives PR:N/AV:N/AC:L; scope-change retained as DB spans components; raised I:N→I:L since SQLi typically allows some write/manipulation.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.
AnalysisAI
Unauthenticated SQL injection in the GeoDirectory WordPress plugin (versions up to and including 2.8.152) allows remote attackers to inject arbitrary SQL into backend database queries without any credentials or user interaction. The flaw was disclosed via Patchstack and tracked as EUVD-2026-36951; no public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of the GeoDirectory WordPress plugin at versions ≤2.8.152 (CVSS AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Risk is high in aggregate: CVSS 9.3 reflects AV:N/AC:L/PR:N/UI:N (remote, low complexity, no auth, no user interaction) with a Scope change (S:C) indicating the injection can read data beyond the vulnerable component's privilege boundary, and impact metrics show C:H (full database confidentiality compromise - credentials hashes, user PII, session tokens), I:N (no direct integrity impact claimed), and A:L (limited availability impact from heavy queries or locks). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker scans WordPress sites for the GeoDirectory plugin (fingerprintable via /wp-content/plugins/geodirectory/ asset paths), then sends a crafted HTTP request to a vulnerable directory search or listing endpoint with malicious SQL injected into a query parameter, executing a UNION-based extraction of wp_users credentials and session tokens. The attacker then cracks or replays an administrator session to pivot into full WordPress site takeover via the plugin/theme editor or PHP file upload. … |
| Remediation | Upstream fix available per Patchstack advisory; released patched version not independently confirmed in the provided data, so administrators should upgrade GeoDirectory to the latest version above 2.8.152 published on wordpress.org or via the plugin's update channel and verify the installed version after upgrade. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all WordPress sites running GeoDirectory and confirm installed versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today