Cross Site Request Forgery Vulnerability in GeoDirectory by WordPress
CVE-2026-81271

8.8HIGH

Key Information:

Vendor

WordPress
Status
Geodirectory
Vendor
CVE Published:
27 August 2026

What is CVE-2026-81271?

A security flaw in GeoDirectory versions up to 2.8.176 allows unauthenticated users to execute unsafe actions on behalf of legitimate users. Specifically, the Cross Site Request Forgery (CSRF) vulnerability can lead to unintended administrative actions, potentially compromising website integrity and user data. It is crucial for users of affected versions to apply necessary patches and updates to safeguard their applications.

Affected Version(s)

GeoDirectory <= 2.8.176

References

https://patchstack.com/database/wordpress/plugin/geodirec...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Brian Willows | Patchstack Bug Bounty Program
.