GeoDirectory EUVD-2026-96104

Exploitation targets the GeoDirectory tags-widget AJAX path (class-geodir-widget-tags.php / template-functions.php) reachable on default installs: the attacker needs only the geodir_basic_nonce, which the plugin localizes into the geodir_params script object on every public frontend page, so no authentication, no user interaction, and no specific site content are required to reach the LFI. The limiting factor is impact escalation, not access: including an existing server-side .php file yields access-control bypass and sensitive-data disclosure immediately, but achieving arbitrary PHP code execution additionally requires an attacker-controllable .php file to already exist or be uploadable on the server. Sites running 2.8.188 or later are not affected (design_type is restricted to a fixed allowlist and template names are validated against traversal/null bytes).

This is a credible real-world priority, though its severity hinges on a secondary condition. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1 High) marks it network-reachable and unauthenticated (PR:N), with full CIA impact reflecting potential remote code execution (CWE-98, PHP Remote File Inclusion / LFI). The AC:H rating is the key tension point: the description explicitly contradicts the premise that exploitation is hard, stating the required geodir_basic_nonce is 'trivially obtainable by any anonymous visitor' because it is localized to every public frontend page - so the real barrier to AC is NOT the nonce. The more defensible justification for complexity is that full code execution requires an attacker-controllable .php file already present/uploadable on the server; pure inclusion of existing server PHP is more reliable but lower-impact. No EPSS score, KEV listing, or POC was provided in the input, so exploitation likelihood cannot be quantified from the data; status is 'no public exploit identified at time of analysis.' The signals do not conflict on severity - unauthenticated network LFI in a public WordPress plugin is inherently attractive to opportunistic scanning - but defenders should treat the C:H/I:H/A:H (RCE) outcome as conditional on the .php-upload prerequisite, while the information-disclosure / access-control-bypass outcome via inclusion of existing local PHP is immediate.

An unauthenticated attacker loads any public page of a GeoDirectory site, scrapes the geodir_basic_nonce from the localized geodir_params script object, then sends a crafted AJAX request manipulating the 'design_type' parameter to traverse into and include an arbitrary local .php file. If the attacker can first plant a .php payload (e.g., via an upload feature) the inclusion yields remote code execution; otherwise it still enables access-control bypass and disclosure of sensitive local PHP files. No public exploit was identified in the provided data.