CVE-2026-24549

Vulnerability

Overview

The GeoDirectory WordPress plugin, versions 2.8.149 and earlier, contains a Cross-Site Request Forgery (CSRF) vulnerability [1]. This flaw arises from insufficient validation of request origins, enabling an attacker to craft malicious requests that appear legitimate to the server.

Exploitation

Details

Exploitation requires user interaction: a privileged user (such as an administrator) must click a malicious link, visit a crafted page, or submit a specially designed form while authenticated [1]. No additional privileges are not required for the attacker to initiate the attack, but the victim must have higher privileges for the attack to succeed.

Impact

Successful exploitation allows an attacker to force the victim to perform unintended actions under their current authentication, such as changing settings or modifying content [1]. The CVSS v3 score is 4.3 (Medium), indicating a moderate severity with low impact potential.

Mitigation

The vendor has released version 2.8.150 which resolves this vulnerability [1]. Users are strongly advised to update immediately. For those unable to update, they should contact their hosting provider or web developer for assistance [1].