{"id":"CVE-2026-113673","kind":"vulnerability","aliases":["CVE-2026-113673"],"related":[],"title":"GeoDirectory WordPress plugin: unescaped admin text enables code execution","description":"The GeoDirectory  WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.","summary":"The GeoDirectory WordPress plugin writes administrator-defined text into a generated PHP file without escaping it. A high-privilege user, such as a multisite subsite administrator, can inject PHP that any unauthenticated visitor then triggers, leading to remote code execution.","severity":"high","cvss":null,"epss":0.00285,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["multisite","package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["geodirectory-2.8.194-or-later","no-geodirectory"],"how_to_check":"- Check the installed GeoDirectory version in the WordPress admin plugin list or with `wp plugin get geodirectory --field=version`\n- Look for generated PHP files in the GeoDirectory plugin folder and review them for injected code\n- unknown for any further checks the sources do not describe","fix":"- Update GeoDirectory to `2.8.194` or later\n- Review and remove any unexpected generated PHP files in the plugin folder after updating\n- unknown for any other fix the sources do not describe","status":"open","published_at":"2026-10-24T06:16:36+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","triaged_at":"2026-10-25T04:51:53+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:51:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update GeoDirectory to `2.8.194` or later\n- Review and remove any unexpected generated PHP files in the plugin folder after updating\n- unknown for any other fix the sources do not describe","reach":"internet","title":"GeoDirectory WordPress plugin: unescaped admin text enables code execution","impact":"high","summary":"The GeoDirectory WordPress plugin writes administrator-defined text into a generated PHP file without escaping it. A high-privilege user, such as a multisite subsite administrator, can inject PHP that any unauthenticated visitor then triggers, leading to remote code execution.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","multisite","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Unauthenticated visitors trigger injected PHP code, running commands on the server","analyst_note":"Check the NVD entry and the WordPress plugin changelog for the exact affected range and the trigger path for the generated file.","how_to_check":"- Check the installed GeoDirectory version in the WordPress admin plugin list or with `wp plugin get geodirectory --field=version`\n- Look for generated PHP files in the GeoDirectory plugin folder and review them for injected code\n- unknown for any further checks the sources do not describe","needs_analyst":true,"not_affected_if":["geodirectory-2.8.194-or-later","no-geodirectory"],"who_is_affected":"Sites running GeoDirectory before `2.8.194`, especially WordPress multisite networks where subsite administrators can edit plugin settings. The exposure comes from admin-defined text that ends up in generated PHP files that visitors can reach. Sites without GeoDirectory, or running `2.8.194` or later, can skip this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000662,"input_tokens":3330,"output_tokens":658,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113673':12A,15A '-2026':11A,14A '2.8.194':72C 'achiev':112C 'admin':5A 'administr':31B,52B,78C,101C 'administrator-defin':30B,77C 'allow':93C 'cannot':107C 'code':8A,65B,110C,114C 'cve':10A,13A 'defin':32B,79C 'enabl':7A 'escap':40B,76C 'execut':9A,66B,115C 'file':38B,88C 'folder':92C 'generat':36B,86C 'geodirectori':1A,26B,68C 'high':44B,94C 'high-privileg':43B 'host':20B 'inject':54B 'lead':62B 'multisit':16B,50B,104C 'network':105C 'otherwis':108C 'packag':17B 'php':37B,55B,87C 'plugin':3A,24B,28B,70C 'privileg':45B,95C 'proper':75C 'remot':64B,113C 'run':109C 'self':19B 'self-host':18B 'subsit':51B,100C 'text':6A,33B,80C 'trigger':61B,121C 'unauthent':58B,118C 'unescap':4A 'user':46B,96C 'visitor':59B,119C 'without':39B 'wordpress':2A,21B,23B,27B,69C 'wordpress-plugin':22B 'write':29B,82C","nicknames":[],"mitigations":[],"who_affected":"Sites running GeoDirectory before `2.8.194`, especially WordPress multisite networks where subsite administrators can edit plugin settings. The exposure comes from admin-defined text that ends up in generated PHP files that visitors can reach. Sites without GeoDirectory, or running `2.8.194` or later, can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T06:16:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113673","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113673","severity":null,"published_at":"2026-10-24T06:16:36+00:00","modified_at":"2026-10-24T06:16:36+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","fetched_at":"2026-10-24T06:47:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-113673","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113673","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}