WordPress Plugin Vulnerabilities

GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification

Description

The plugin does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.

Proof of Concept

Affects Plugins

Plugin icon
geodirectory
Fixed in 2.8.194

References

CVE
CVE-2026-113674

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
3.7 (low)

Miscellaneous

Original Researcher
Vincent Suen (GreenHat Security)
Submitter
Vincent Suen
Verified
Yes
WPVDB ID
23e66ca1-50eb-4ac1-9f5f-f830235c5af0

Timeline

Publicly Published
2026-10-22 (about 2 days ago)
Added
2026-10-22 (about 1 day ago)
Last Updated
2026-10-22 (about 1 day ago)

Other

Published
Title
Published
2024-08-31
Title
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder < 5.1.19 - Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification
Published
2026-10-12
Title
Product Feed for Google Shopping < 5.3.2 - Unauthenticated Forced Store Registration
Published
2025-07-03
Title
DocCheck Login < 1.1.6 - Unauthorized Post Access
Published
2021-08-23
Title
Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Update
Published
2021-09-20
Title
Multiple Plugins from CatchThemes - Unauthorised Plugin's Setting Change