{
 "id": "WPSEC-2026-2111",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2111/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2111/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2111/index.md",
 "title": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.198 - Cross-Site Request Forgery to Comment Moderation via Predictable Token",
 "description": "The GeoDirectory plugin for WordPress is vulnerable to Cross-Site Request Forgery via the comment moderation links handled by geodir_post_author_moderate_comment() in all versions up to, and including, 2.8.198. This is due to the moderation token being an unkeyed md5 hash of the action name and the comment ID, which anyone can compute. This makes it possible for unauthenticated attackers to approve, trash or spam unapproved comments on a listing through a forged request, granted they can trick the listing's author or a user with the moderate_comments capability into clicking a link.",
 "plugin": {
  "slug": "geodirectory",
  "name": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory",
  "full_name": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory",
  "wordpress_org": "https://wordpress.org/plugins/geodirectory/",
  "advisories_url": "https://wpsec.com/vuln/plugin/geodirectory/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/geodirectory"
 },
 "type": "CSRF",
 "cwe": [
  "CWE-352"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.8.199",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.8.199"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.8.199",
 "remediation": "Update to 2.8.199 or later.",
 "fix_released": "2026-10-29T14:43:27+00:00",
 "published": "2026-10-30T14:47:12+00:00",
 "updated": "2026-10-30T09:24:33.827956+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2111/",
  "https://plugins.svn.wordpress.org/geodirectory/tags/2.8.199/",
  "https://wordpress.org/plugins/geodirectory/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/geodirectory",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}