WordPress Plugin Vulnerabilities

GeoDirectory < 2.8.150 - Cross-Site Request Forgery

Description

The GeoDirectory plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.149. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
geodirectory
Fixed in 2.8.150

References

CVE
CVE-2026-24549
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/fcfe2625-3ee8-4822-8088-abf0b898bebb

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Trương Hữu Phúc (truonghuuphuc)
Verified
No
WPVDB ID
aed9fdb6-e11c-4608-a105-ca6ae320e117

Timeline

Publicly Published
2026-01-23 (about 4 months ago)
Added
2026-01-27 (about 4 months ago)
Last Updated
2026-01-28 (about 4 months ago)

Other

Published
Title
Published
2025-09-22
Title
NIX Anti-Spam Light <= 0.0.4 - Cross-Site Request Forgery
Published
2025-03-05
Title
Podlove Podcast Publisher < 4.2.3 - Cross-Site Request Forgery via ajax_transcript_delete Function
Published
2016-10-27
Title
GoDaddy Email Marketing <= 1.1.3 - Cross-Site Request Forgery (CSRF)
Published
2025-03-03
Title
Recapture for WooCommerce < 1.0.44 - Cross-Site Request Forgery to Settings Update
Published
2019-07-16
Title
Ultra Simple Paypal Shopping Cart <= 4.4 - Cross-Site Request Forgery (CSRF)