{"id":"CVE-2026-113674","aliases":["EUVD-2026-109217","GHSA-pjph-x42v-fp6x"],"status":"published","title":"GeoDirectory \u003c 2.8.194 - Unauthenticated Guest-Submitted Listing Modification","description":"The GeoDirectory  WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00206,"percentile":0.10702,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2026-10-24T06:00:20Z","modified":"2026-10-26T13:50:14Z","products":[{"vendor":"paolo","product":"geodirectory"},{"vendor":"unknown","product":"geodirectory"}],"references":[{"url":"https://wpscan.com/vulnerability/23e66ca1-50eb-4ac1-9f5f-f830235c5af0/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113674"},{"url":"https://wpscan.com/vulnerability/23e66ca1-50eb-4ac1-9f5f-f830235c5af0"},{"url":"https://github.com/advisories/GHSA-pjph-x42v-fp6x"}],"sources":{"cve":[{"id":"CVE-2026-113674","title":"GeoDirectory \u003c 2.8.194 - Unauthenticated Guest-Submitted Listing Modification","description":"The GeoDirectory  WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.","status":"published","published":"2026-10-24T06:00:20.014Z","modified":"2026-10-24T14:36:53.488Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T13:44:29.519518Z"}],"euvd":[{"id":"EUVD-2026-109217","description":"The GeoDirectory  WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.","status":"published","published":"2026-10-24T06:00:20Z","modified":"2026-10-24T14:36:53Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:59:30.708699Z"}],"ghsa":[{"id":"GHSA-pjph-x42v-fp6x","title":"The GeoDirectory  WordPress plugin before 2.8.194 does not correctly verify ownership of listings...","description":"The GeoDirectory  WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.","status":"published","published":"2026-10-24T06:30:29Z","modified":"2026-10-24T15:32:56Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:14:22.008612Z"}],"nvd":[{"id":"CVE-2026-113674","description":"The GeoDirectory  WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.","status":"published","published":"2026-10-24T06:16:37.027Z","modified":"2026-10-26T13:50:14.083Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:13:03.126833Z"}]}}