GeoDirectory - Security Vulnerability (CVE-2026-84813)
CVE-2026-84813
Unauthenticated SQL Injection in GeoDirectory
CVE-2026-84813
CVE-2026-84813
Unauthenticated SQL Injection in GeoDirectory
CVE-2026-84813
Machine-generated threat intelligence
AI Updated just now
AI enriched just now (2026-09-05 05:39 UTC)
Unauthenticated SQL Injection in GeoDirectory
Severity is CRITICAL (CVSS 9.3). Depending on deployment context, affected components may be exposed to unauthorized actions or data integrity risk.
Exploitability is assessed as High based on low-bar exploit prerequisites.
Primary risk drivers: low-bar exploit prerequisites
Validate affected product versions, prioritize patching, and monitor references for vendor remediation guidance. If immediate patching is not possible, apply compensating controls and limit exposure of vulnerable surfaces.
Track authentication anomalies, unexpected file writes, and suspicious plugin API activity around affected components.
AI risk score 92/100 (Critical, High) with priority P1 Immediate. Prioritize remediation where affected components process customer data, admin sessions, or Internet-exposed workflows.
Patch immediately Serious, and reachable without meaningful privilege.
Update GeoDirectory to 2.8.175 or later.
That is the complete fix. Everything below is what protects you in the meantime.
Cannot update today? Request / payload inspection (WAF) in Hack Halt ProSecure blocks this class of attack before WordPress processes the request.
Inspect request parameters and bodies for injection, traversal and file-inclusion payloads, and refuse the request rather than logging it.
Scan your site to see whether it runs GeoDirectory, and at which version.
Free, no installation, no account. It reads what your site already publishes, then tells you which plugins carry known vulnerabilities and what to do about each one.
You are affected if your site runs GeoDirectory. Versions below 2.8.175 are vulnerable; that release and later are not. No account is needed to exploit this, so a public site is reachable by anyone.
Update GeoDirectory to version 2.8.175 or later. That is the complete fix. Until you can update, Request / payload inspection (WAF) in Hack Halt ProSecure contains this class of attack at the request layer.
This is a SQL Injection flaw. An attacker who exploits it can read, alter or delete anything in the site database, including user accounts and password hashes.