Is CVE-2026-57681 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57681 being exploited in the wild.

How severe is CVE-2026-57681?

Medium severity, with a CVSS score of 6.4, published 2 July 2026.

Is there a fix for CVE-2026-57681?

A patch was published on 2026-07-02: NVD publication and patch availability confirmed in version 2.8.162 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57681 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57681?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57681: Paolo GeoDirectory SSRF in WordPress plugin

CVE-2026-57681 · Severity: medium · CVSS 6.4 · Published 2026-07-02

GeoDirectory, a WordPress plugin used to create business directories, is vulnerable to a security flaw that allows authenticated users to make the server perform unauthorized web requests. An attacker with a basic 'Subscriber' account could use this to probe internal network services or access sensitive information that is not publicly available. This could lead to internal data exposure or be used as a stepping stone for further attacks on the organization's infrastructure.

Quick answers

Is CVE-2026-57681 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57681 being exploited in the wild.
How severe is CVE-2026-57681?: Medium severity, with a CVSS score of 6.4, published 2 July 2026.
Which products and versions are affected?: Paolo GeoDirectory <= 2.8.161.
Is there a fix for CVE-2026-57681?: A patch was published on 2026-07-02: NVD publication and patch availability confirmed in version 2.8.162 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57681 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57681?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the GeoDirectory plugin for WordPress (versions up to and including 2.8.161). The flaw is classified as CWE-918 and stems from insufficient validation of user-supplied URLs, allowing the server to execute requests to arbitrary domains. An attacker authenticated with Subscriber-level privileges can exploit this to scan internal networks, interact with internal services, or bypass firewalls. The vulnerability has been addressed in version 2.8.162.

Affected products

Paolo GeoDirectory <= 2.8.161

Timeline

2026-05-16: disclosed: Reported by dodoh4t
2026-06-30: advisory: Patchstack published advisory
2026-07-02: patched: NVD publication and patch availability confirmed in version 2.8.162

References

https://patchstack.com/database/wordpress/plugin/geodirectory/vulnerability/wordpress-geodirectory-plugin-2-8-161-server-side-request-forgery-ssrf-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.