Live › vulnerability › CVE-2026-113674
Go to dashboardThe GeoDirectory WordPress plugin before 2.8.194 does not check ownership of listings submitted by logged-out users before allowing edits. An unauthenticated attacker can modify, unpublish, reassign, or add images to any guest-submitted listing when guest posting is enabled.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 06:47 UTC. All times on this page are UTC.
Sites running the GeoDirectory plugin before 2.8.194 with guest posting enabled are exposed, because logged-out visitors can then reach the edit path for listings. Sites with guest posting disabled or no GeoDirectory plugin can skip it.
No product ranges from the sources yet.
2.8.194 are affected.2.8.194 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.
This page as .md · .json · in your agent: get_signal("CVE-2026-113674")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.