Vulnerabilities / GeoDirectory – WP Business Directory Plugin and Classified Listings Directory / WPSEC-2026-2111
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.198 - Cross-Site Request Forgery to Comment Moderation via Predictable Token
Medium 4.3
CWE-352Fixed in 2.8.199
- ID
- WPSEC-2026-2111
- Plugin
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (geodirectory)
- Affected
- all versions before 2.8.199
- Remediation
- Update to 2.8.199 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Weakness
- CWE-352
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory on WPSec AttackSurface
- Fix released
- Published
Description
The GeoDirectory plugin for WordPress is vulnerable to Cross-Site Request Forgery via the comment moderation links handled by geodir_post_author_moderate_comment() in all versions up to, and including, 2.8.198. This is due to the moderation token being an unkeyed md5 hash of the action name and the comment ID, which anyone can compute. This makes it possible for unauthenticated attackers to approve, trash or spam unapproved comments on a listing through a forged request, granted they can trick the listing's author or a user with the moderate_comments capability into clicking a link.
References
- https://wpsec.com/vuln/WPSEC-2026-2111/
- https://plugins.svn.wordpress.org/geodirectory/tags/2.8.199/
- https://wordpress.org/plugins/geodirectory/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS