CVE-2026-84813

GeoDirectory versions up to and including 2.8.174 contain an unauthenticated SQL injection flaw (CWE-89) in which attacker-controlled input reaches a database query without proper sanitization. Because the flaw is reachable over the network without authentication or user interaction, an unauthenticated attacker can send crafted requests to trigger it. Successful exploitation primarily exposes database contents (high confidentiality impact, per the CVSS score), with only limited availability impact and no direct integrity impact; exposed data could include directory listings and other site data stored in the WordPress database. Any WordPress site running GeoDirectory 2.8.174 or earlier is affected. Exploitation has not been confirmed: there is no public proof-of-concept, the CVE is not in CISA KEV, and EPSS puts 30-day exploitation probability at only about 0.2%.

What to do: Update GeoDirectory to the latest release (any version newer than 2.8.174) as soon as possible, since no authentication is required for exploitation. Until patched, sites should check access logs for suspicious requests hitting directory/search parameters and consider applying a WAF rule that blocks common SQL injection patterns.