CVE-2026-42671: GeoDirectory Auth Bypass Vulnerability

CVE-2026-42671 Overview

CVE-2026-42671 is a Missing Authorization vulnerability [CWE-862] in the GeoDirectory plugin for WordPress, developed by Paolo. The flaw affects all versions of GeoDirectory up to and including 2.8.157. Incorrectly configured access control security levels allow unauthenticated network attackers to invoke functions that should require authorization. Exploitation requires no user interaction and no privileges, lowering the barrier for attackers targeting WordPress sites running the affected plugin.

Critical Impact
Unauthenticated attackers can reach protected GeoDirectory plugin functionality over the network, resulting in limited integrity and availability impact on affected WordPress sites.

Affected Products

GeoDirectory WordPress plugin versions up to and including 2.8.157
WordPress sites using the Paolo GeoDirectory plugin
Any WordPress deployment that has not updated GeoDirectory beyond 2.8.157

Discovery Timeline

2026-06-01 - CVE-2026-42671 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-42671

Vulnerability Analysis

The vulnerability stems from missing authorization checks within the GeoDirectory plugin. The plugin exposes functionality that should validate the caller's permissions but fails to enforce those checks consistently. As a result, attackers can reach protected actions without holding the required role or capability.

The weakness is classified as Broken Access Control under [CWE-862]. Such flaws typically allow attackers to perform state-changing operations or read data restricted to authenticated users. In this case, the attack vector is network-based, no privileges are required, and no user interaction is needed.

The EPSS score is 0.038 percent, placing the vulnerability in the 11.579 percentile for likelihood of exploitation. No public exploit is currently listed, and the issue is not present in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is the absence or misconfiguration of capability checks, such as current_user_can() or nonce validation, on one or more GeoDirectory plugin endpoints. WordPress plugins commonly expose admin-ajax.php actions or REST API routes that must verify the caller's identity and role. When those checks are omitted, any network user can invoke the endpoint.

Attack Vector

An attacker sends crafted HTTP requests directly to the vulnerable GeoDirectory endpoints. Because no authentication or user interaction is required, the attack can be automated and executed at scale against any WordPress site running a vulnerable version. The resulting impact is limited to integrity and availability rather than confidentiality, indicating that affected actions modify or disrupt plugin state rather than expose sensitive data. Refer to the Patchstack Vulnerability Report for further technical details.

Detection Methods for CVE-2026-42671

Indicators of Compromise

Unexpected modifications to GeoDirectory listings, categories, or settings without corresponding administrator activity in audit logs.
HTTP POST or GET requests from unauthenticated sessions targeting GeoDirectory admin-ajax.php actions or REST routes under /wp-json/geodir/.
Spikes in 200 OK responses to GeoDirectory endpoints originating from a single IP or small set of IPs.

Detection Strategies

Inventory WordPress installations and identify any running GeoDirectory at version 2.8.157 or earlier.
Review web server access logs for repeated unauthenticated requests to GeoDirectory plugin endpoints.
Correlate WordPress database changes against expected administrative activity to surface unauthorized writes.

Monitoring Recommendations

Enable WordPress activity logging plugins to capture authenticated and unauthenticated actions against the plugin.
Forward web server and WordPress logs to a centralized SIEM for retention and correlation.
Configure alerts for anomalous traffic volumes to /wp-admin/admin-ajax.php and GeoDirectory REST endpoints.

How to Mitigate CVE-2026-42671

Immediate Actions Required

Identify all WordPress sites running GeoDirectory and confirm the installed version.
Update GeoDirectory to a version released after 2.8.157 that addresses the missing authorization issue.
Restrict access to WordPress administrative endpoints using a web application firewall (WAF) until patching is complete.

Patch Information

The vulnerability affects GeoDirectory through version 2.8.157. Site administrators should monitor the Patchstack Vulnerability Report and the official plugin repository for a fixed release and apply it across all affected sites.

Workarounds

Deactivate the GeoDirectory plugin until a patched version is available and installed.
Apply WAF rules that block unauthenticated requests to GeoDirectory admin-ajax.php actions and REST routes.
Limit access to /wp-admin/ and /wp-json/ paths by IP allowlist where operationally feasible.

bash

# Configuration example: example nginx rule to restrict GeoDirectory REST endpoints
location ~ ^/wp-json/geodir/ {
    allow 203.0.113.0/24;
    deny all;
}