CVE-2026-113674
CVE-2026-113674 · GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.
CVSS 3.7 · Low · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
geodirectory
- Versions
- ≥ 0, < 2.8.194: Affected (semver)
Update to 2.8.194