EUVD-2026-70569
GHSA-gwp5-8mcq-2w77
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Remote unauthenticated SQLi (AV:N/AC:L/PR:N/UI:N) with high data-disclosure but no confirmed write or DoS; SQLi stays within the app authority so S:U, giving ~7.5.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.
Articles & Coverage 1
AnalysisAI
SQL injection in the GeoDirectory WordPress plugin (versions 2.8.174 and earlier) lets unauthenticated remote attackers inject SQL into backend database queries, per a Patchstack advisory. The flaw carries a CVSS of 9.3 driven largely by a scope-change assumption, and enables extraction of sensitive database contents (user credentials, secrets, PII). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network reachability to a WordPress site running GeoDirectory <= 2.8.174 with the vulnerable directory/listing feature exposed to anonymous users; per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are needed against a default installation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, 9.3) describes an easy, remote, unauthenticated read-primarily attack; the elevated score depends heavily on the S:C scope change (treating the database as a separate authority) - with the more common S:U for plugin SQLi the base score falls to roughly 7.5. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update GeoDirectory to a release later than 2.8.174 as soon as the vendor-fixed version is confirmed via the Patchstack advisory and the plugin changelog (the provided data does not name an exact patched version, so verify the fixed build before deploying - Patch available per advisory, released fixed version not independently confirmed here). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all WordPress installations to identify those running GeoDirectory plugin version 2.8.174 or earlier and immediately deactivate the plugin as a temporary mitigation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Geodirectory
View allInformation disclosure in the GeoDirectory WordPress plugin (before 2.8.168) exposes the email addresses of all register
The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before o
The GeoDirectory Business Directory WordPress plugin before 2.1.1.3 was vulnerable to Authenticated Stored Cross-Site Sc
Unauthenticated SQL injection in the GeoDirectory WordPress plugin (versions up to and including 2.8.152) allows remote
Cross-Site Request Forgery in the GeoDirectory WordPress plugin (versions ≤ 2.8.176) enables remote unauthenticated atta
Missing Authorization vulnerability in AyeCode - WP Business Directory Plugins GeoDirectory allows Exploiting Incorrectl
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode Ltd GeoDir
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode - WordPres
Stored Cross-Site Scripting in GeoDirectory WordPress plugin before 2.8.110 allows authenticated editors and higher-priv
The GeoDirectory WordPress plugin before 2.2.24 does not properly sanitise and escape a parameter before using it in a S
Cross-site scripting in the GeoDirectory WordPress plugin (versions ≤ 2.8.173) enables unauthenticated remote attackers
Stored Cross-Site Scripting in the GeoDirectory WordPress plugin (versions <= 2.8.172) enables authenticated contributor
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today