CVE Intelligence
Analysis AI-assisted

CVE-2026-54831: GeoDirectory WordPress Plugin Unauthenticated SQL Injection

CVE-2026-54831 is an unauthenticated SQL injection flaw in the GeoDirectory WordPress plugin, affecting versions up to and including 2.8.162 according to the record. The CNA Patchstack assigned a CVSS 3.1 base score of 9.3 (Critical) with a network attack vector and no privileges required. No KEV listing or confirmed exploitation appears in the sources consulted, and the record does not list a fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-54831 describes an unauthenticated SQL injection vulnerability (CWE-89) in the GeoDirectory plugin for WordPress. The record was published on 2026-06-26 and was reported by the CNA Patchstack. The vulnerability class allows database query logic to be altered through untrusted input, which is why it is rated critical.

Impact

The CVSS 3.1 vector recorded by the CNA is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. This indicates network reachability, low attack complexity, no privileges and no user interaction required, a changed scope, high confidentiality impact, no integrity impact and low availability impact. The practical consequence is likely unauthorized reading of data stored in the site database, but the record does not describe specific data affected.

Affected products and versions

  • GeoDirectory plugin for WordPress, versions up to and including 2.8.162, as stated in the record description.
  • No fixed version is listed in the record. The absence of a listed fix does not mean none exists; consult the vendor and the Patchstack advisory.

Exploitation status

The record shows KEV listed as false. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability recorded is 0.004 with a percentile of 0.32422, which is a statistical estimate and not evidence of exploitation.

Remediation and mitigation

  • Identify whether any site runs the GeoDirectory plugin and check its installed version against the affected range.
  • Update to a release newer than 2.8.162 once the vendor confirms it contains the fix; the record does not identify the fixed release.
  • If an update is not immediately possible, consider temporarily disabling the plugin or restricting access to affected functionality, and apply web application firewall rules from your security provider as a compensating control.
  • Limit database account privileges for the WordPress database user to reduce the impact of any injection.

Detection guidance

  • Review web server and application logs for unusual requests to GeoDirectory endpoints, especially unexpected parameter values or spikes from unfamiliar sources.
  • Watch for database error messages or anomalous query activity in application logs.
  • Verify file integrity and review administrative accounts if compromise is suspected.

Limitations of the available information

  • The record does not identify the vulnerable parameter, endpoint or function.
  • No fixed version is stated.
  • The NVD entry is referenced but the record shows only the Patchstack score; no additional NVD score is present in the record.
  • The record's source status is Deferred, so further analysis may change the information.

Frequently asked questions

Which GeoDirectory versions are affected by CVE-2026-54831?

The record describes the issue as affecting GeoDirectory versions up to and including 2.8.162. The record does not list a fixed version, so check the vendor advisory before deciding on an update.

Is CVE-2026-54831 being actively exploited?

The record shows the vulnerability is not in the KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.

What is the severity of CVE-2026-54831?

The CNA Patchstack assigned a CVSS 3.1 base score of 9.3, rated critical, with a network attack vector and no privileges required.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.