← Back to the live CVE advisory feed

CVE-2026-113673: GeoDirectory

Severity

7.2 (HIGH)

Affected versions

0 through before 2.8.194

Fixed version

2.8.194

Patch status

Patched

Published

2026-10-24T06:16:36.907

Why it matters

A flaw in the GeoDirectory WordPress plugin (versions prior to 2.8.194) allows high-privilege users, such as a subsite administrator on a multisite network, to achieve Remote Code Execution. This RCE can then be triggered by any unauthenticated visitor, posing a significant risk of full site comprom

Recommended admin actions

• Identify all WordPress installations using the GeoDirectory plugin.
• Immediately upgrade the GeoDirectory plugin to version 2.8.194 or later.
• Prioritize patching for internet-facing WordPress sites or those in a multisite network.
• If immediate upgrade is not feasible, consider temporarily disabling the plugin until it can be updated.

Technical summary

The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.

View the official NVD record for CVE-2026-113673

AI-enriched (MEDIUM confidence). Validate against the vendor advisory before taking production action.