Is CVE-2026-42671 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42671 being exploited in the wild.

How severe is CVE-2026-42671?

Medium severity, with a CVSS score of 6.5, published 1 June 2026.

Which products and versions are affected?

AyeCode Ltd GeoDirectory <= 2.8.157.

Is there a fix for CVE-2026-42671?

A patch was published on 2026-05-13: Version 2.8.158 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42671 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-42671?

Check whether you run AyeCode Ltd GeoDirectory at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42671: Paolo GeoDirectory missing authorization in WordPress plugin

Q: Is there a fix for CVE-2026-42671?

A patch was published on 2026-05-13: Version 2.8.158 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42671 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-42671?

Check whether you run AyeCode Ltd GeoDirectory at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42671 · Severity: medium · CVSS 6.5 · Published 2026-06-01

GeoDirectory is a WordPress plugin used to create business directories and location-based listings. A security flaw in the plugin allows unauthorized individuals to bypass access controls and perform actions they should not be permitted to do. This could lead to unauthorized changes to directory listings or disruption of the service, potentially impacting the integrity of the site's data and its reputation.

Technologies: AyeCode Ltd GeoDirectory. Vendors: AyeCode Ltd.

Quick answers

Is CVE-2026-42671 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42671 being exploited in the wild.
How severe is CVE-2026-42671?: Medium severity, with a CVSS score of 6.5, published 1 June 2026.
Which products and versions are affected?: AyeCode Ltd GeoDirectory <= 2.8.157.
Is there a fix for CVE-2026-42671?: A patch was published on 2026-05-13: Version 2.8.158 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42671 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42671?: Check whether you run AyeCode Ltd GeoDirectory at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The GeoDirectory plugin for WordPress (versions up to and including 2.8.157) is vulnerable to broken access control due to missing authorization checks (CWE-862). This flaw allows an unauthenticated remote attacker to execute functions or actions that should be restricted to higher-privileged users. The vulnerability stems from a failure to validate user permissions or implement proper nonce tokens before processing specific requests. Attackers can exploit this to modify data or impact the availability of the directory service. The issue is resolved in version 2.8.158.

Affected products

Paolo GeoDirectory <= 2.8.157

Timeline

2026-04-13: other: Vulnerability reported by researcher Evan NR
2026-05-13: advisory: Initial advisory published by Patchstack
2026-06-01: disclosed: CVE published in NVD
2026-05-13: patched: Version 2.8.158 released to address the issue

References

https://patchstack.com/database/wordpress/plugin/geodirectory/vulnerability/wordpress-geodirectory-plugin-2-8-157-broken-access-control-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.