# GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.198 - Cross-Site Request Forgery to Comment Moderation via Predictable Token

- **ID:** WPSEC-2026-2111
- **Plugin:** GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (`geodirectory`), https://wordpress.org/plugins/geodirectory/
- **Affected versions:** all versions before 2.8.199
- **Fixed in:** 2.8.199 (Update to 2.8.199 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-352
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/geodirectory
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2111/

## Description

The GeoDirectory plugin for WordPress is vulnerable to Cross-Site Request Forgery via the comment moderation links handled by geodir_post_author_moderate_comment() in all versions up to, and including, 2.8.198. This is due to the moderation token being an unkeyed md5 hash of the action name and the comment ID, which anyone can compute. This makes it possible for unauthenticated attackers to approve, trash or spam unapproved comments on a listing through a forged request, granted they can trick the listing's author or a user with the moderate_comments capability into clicking a link.

## References

- https://wpsec.com/vuln/WPSEC-2026-2111/
- https://plugins.svn.wordpress.org/geodirectory/tags/2.8.199/
- https://wordpress.org/plugins/geodirectory/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2111/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.