Live › vulnerability › CVE-2026-113673
Go to dashboardThe GeoDirectory WordPress plugin writes administrator-defined text into a generated PHP file without escaping it. A high-privilege user, such as a multisite subsite administrator, can inject PHP that any unauthenticated visitor then triggers, leading to remote code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 06:47 UTC. All times on this page are UTC.
Sites running GeoDirectory before 2.8.194, especially WordPress multisite networks where subsite administrators can edit plugin settings. The exposure comes from admin-defined text that ends up in generated PHP files that visitors can reach. Sites without GeoDirectory, or running or later, can skip this.
2.8.194No product ranges from the sources yet.
wp plugin get geodirectory --field=version2.8.194 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.
This page as .md · .json · in your agent: get_signal("CVE-2026-113673")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.