CVE-2024-43981: GeoDirectory Auth Bypass Vulnerability

CVE-2024-43981 Overview

CVE-2024-43981 is a missing authorization vulnerability in the AyeCode GeoDirectory plugin for WordPress. The flaw affects all versions of GeoDirectory up to and including 2.3.70. Attackers with low-privilege authenticated access can exploit incorrectly configured access control security levels to perform actions reserved for higher-privileged users. The weakness is categorized as [CWE-862] Missing Authorization and originates from insufficient capability checks within the plugin. Successful exploitation can compromise the confidentiality, integrity, and availability of a WordPress site running the affected plugin.

Critical Impact
Authenticated attackers with minimal privileges can bypass access controls to manipulate directory data and site configuration, leading to full site compromise on vulnerable WordPress installations.

Affected Products

AyeCode GeoDirectory WordPress plugin, versions up to and including 2.3.70
WordPress sites using GeoDirectory as their business directory solution
Any GeoDirectory-dependent add-on relying on the plugin's access control layer

Discovery Timeline

2024-11-01 - CVE-2024-43981 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43981

Vulnerability Analysis

GeoDirectory is a WordPress plugin used to build business directory websites. The vulnerability stems from missing authorization checks on one or more plugin endpoints. When a request reaches these endpoints, the plugin fails to verify whether the calling user holds the capability required to perform the requested action. Any authenticated user, including low-privilege roles such as Subscriber, can invoke the affected functionality.

Exploitation requires network access and low privileges, with no user interaction. This aligns with WordPress-plugin abuse patterns where attackers register as standard users and pivot to privileged actions through broken access control. The impact spans confidentiality, integrity, and availability, since the attacker can read, modify, or destroy directory data managed by the plugin.

Root Cause

The root cause is the absence of current_user_can() capability checks or nonce validation on sensitive plugin handlers. WordPress plugins are expected to enforce role-based authorization before executing state-changing operations. GeoDirectory releases up to 2.3.70 did not consistently apply these checks, exposing privileged operations to any authenticated request.

Attack Vector

An attacker registers or already holds a low-privileged account on the target WordPress site. The attacker sends a crafted HTTP request to a vulnerable GeoDirectory endpoint, invoking functionality that should be restricted to administrators or editors. Because the plugin does not validate the caller's role, the operation executes with the requested effect. Refer to the Patchstack Vulnerability Report for endpoint-level technical details.

Detection Methods for CVE-2024-43981

Indicators of Compromise

Unexpected modifications to GeoDirectory listings, categories, or plugin configuration made by non-administrator accounts
HTTP POST requests to admin-ajax.php or GeoDirectory REST routes originating from Subscriber-level users
Newly created directory entries or altered taxonomy data with no corresponding audit record from an administrator session

Detection Strategies

Review WordPress access logs for authenticated requests to GeoDirectory action handlers issued by low-privilege user IDs
Enable a WordPress audit logging plugin to capture user role, capability, and action metadata for every state-changing request
Correlate directory-content changes with the acting user's role and flag any modification performed by non-editor accounts

Monitoring Recommendations

Monitor the wp_users and wp_usermeta tables for privilege changes and unexpected account activity
Alert on spikes of admin-ajax.php traffic tied to the geodir_ action prefix from unprivileged sessions
Ingest WordPress and web server logs into a centralized log platform for behavioral analysis and long-term retention

How to Mitigate CVE-2024-43981

Immediate Actions Required

Update the GeoDirectory plugin to a version later than 2.3.70 as soon as the vendor patch is deployed
Audit all WordPress user accounts and remove or downgrade unused low-privilege accounts that could be leveraged for exploitation
Review recent directory content and configuration changes for unauthorized modifications and revert them if needed

Patch Information

AyeCode has addressed the missing authorization issue in a release following 2.3.70. Administrators should apply the latest available GeoDirectory update from the WordPress plugin repository. See the Patchstack Vulnerability Report for patch tracking details.

Workarounds

Disable the GeoDirectory plugin until the update is applied if the directory functionality is not business-critical
Restrict new user registration or require administrator approval to reduce the attacker's ability to obtain a low-privilege account
Deploy a web application firewall rule that blocks unauthenticated and low-privilege requests to GeoDirectory action handlers

bash

# Configuration example: disable open user registration in wp-config.php or WordPress settings
wp option update users_can_register 0
wp option update default_role subscriber