CVE-2026-24549: 
WordPress vulnerability analysis and mitigation

CVE-2026-24549 is a Cross-Site Request Forgery (CSRF) vulnerability in the GeoDirectory WordPress plugin developed by Paolo (AyeCode). It affects all versions of the plugin through 2.8.149, with version 2.8.150 being the first patched release. The vulnerability was reported by researcher Trương Hữu Phúc (truonghuuphuc) on December 24, 2025, and publicly disclosed by Patchstack on January 23, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), meaning the plugin fails to properly validate or verify the origin of state-changing requests. An unauthenticated attacker can craft a malicious web page or link that, when visited by an authenticated GeoDirectory user (such as an administrator), causes the victim's browser to submit unauthorized requests to the WordPress site on their behalf. Exploitation requires user interaction — specifically, a privileged user must be tricked into clicking a malicious link or visiting a crafted page while authenticated (Patchstack).

Successful exploitation allows a malicious actor to force higher-privileged users to execute unwanted actions within the GeoDirectory plugin under their current authentication context, resulting in a low integrity impact. Confidentiality and availability are not directly affected. The practical consequence could include unauthorized modification of plugin settings, directory listings, or other data managed by the GeoDirectory plugin, depending on the actions available to the targeted user (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is extremely low at approximately 0.008%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class can be used in mass-exploit campaigns targeting WordPress sites, though this specific issue is rated low priority with unlikely exploitation (Patchstack).

1. Reconnaissance: Identify WordPress sites running the GeoDirectory plugin at version 2.8.149 or earlier using tools like WPScan or Shodan.
2. Craft malicious request: Construct an HTML page or link containing a forged form or AJAX request targeting a GeoDirectory state-changing endpoint (e.g., a settings update or listing modification action) without a valid CSRF nonce.
3. Social engineering: Deliver the malicious link or page to an authenticated GeoDirectory administrator or privileged user via phishing email, forum post, or other social engineering vector.
4. Trigger exploitation: When the victim visits the crafted page or clicks the link while authenticated to their WordPress site, their browser automatically submits the forged request with their session credentials, causing the unintended action to execute on the GeoDirectory plugin (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to GeoDirectory plugin endpoints (e.g., wp-admin/admin-ajax.php or GeoDirectory-specific admin pages) from unusual referrer origins or with missing/invalid nonce values.
• Application: Unexpected changes to GeoDirectory plugin settings, directory listings, or configurations that cannot be attributed to legitimate administrator activity.
• Network: Requests to GeoDirectory admin endpoints originating from external or unfamiliar referrer URLs, which may indicate a CSRF attack in progress.

The vendor has released version 2.8.150 of the GeoDirectory WordPress plugin, which patches this vulnerability. Site administrators should update the plugin to version 2.8.150 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. No configuration-based workaround is available; updating to the patched version is the only recommended remediation (Patchstack).