GeoDirectory EUVD-2026-66949

The GeoDirectory plugin must be installed and active on the target WordPress site at version 2.8.176 or earlier. An authenticated WordPress user - specifically one with permissions sufficient to perform the forged action (typically administrator or editor role) - must visit an attacker-controlled page while their session cookie is valid; the attack cannot proceed without this active user interaction (confirmed by UI:R in the CVSS vector). No special server-side configuration or non-default plugin settings are required, as the CSRF protection gap is present in default plugin installations. Exploitation is bounded by the social engineering requirement: automated scanning or unauthenticated mass exploitation is not possible. Sites where administrators exclusively access the WordPress dashboard from IP-restricted networks are substantially harder to exploit.

The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) captures a real but socially-engineered threat: the attacker requires no privileges or authentication, but must successfully lure an active authenticated WordPress session holder to a malicious page (UI:R). Low attack complexity (AC:L) means no race conditions or non-default configurations are needed beyond having the plugin installed. Full C/I/A impact within the unchanged scope suggests the vulnerable endpoint(s) can trigger highly destructive administrative actions. No EPSS data is provided in the available intelligence, so probability of automated exploitation cannot be quantified. The absence of a KEV listing means mass exploitation is not confirmed, but CSRF vulnerabilities against WordPress admin functions are routinely weaponized in phishing campaigns targeting site owners. Real-world priority is moderate-to-high for sites with active administrative users.

An attacker crafts a hidden HTML auto-submitting form targeting a sensitive GeoDirectory admin endpoint and hosts it on an attacker-controlled domain. The attacker sends a phishing email to the WordPress site administrator with a lure link; when the admin's browser loads the malicious page while their WordPress session is active, the forged POST request is silently submitted with full session credentials. Depending on the targeted endpoint, the outcome could include deletion of directory listings, modification of plugin settings, or privilege escalation for an attacker-controlled user account.