# CVE-2026-57681: Paolo GeoDirectory SSRF in WordPress plugin

Source: https://junglewise.ai/threats/cve-2026-57681-paolo-geodirectory-ssrf-in-wordpress-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-57681 · Severity: medium · CVSS 6.4 · Published 2026-07-02

GeoDirectory, a WordPress plugin used to create business directories, is vulnerable to a security flaw that allows authenticated users to make the server perform unauthorized web requests. An attacker with a basic 'Subscriber' account could use this to probe internal network services or access sensitive information that is not publicly available. This could lead to internal data exposure or be used as a stepping stone for further attacks on the organization's infrastructure.

## Quick answers

**Is CVE-2026-57681 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57681 being exploited in the wild.

**How severe is CVE-2026-57681?** Medium severity, with a CVSS score of 6.4, published 2 July 2026.

**Which products and versions are affected?** Paolo GeoDirectory <= 2.8.161.

**Is there a fix for CVE-2026-57681?** A patch was published on 2026-07-02: NVD publication and patch availability confirmed in version 2.8.162 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57681 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57681?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the GeoDirectory plugin for WordPress (versions up to and including 2.8.161). The flaw is classified as CWE-918 and stems from insufficient validation of user-supplied URLs, allowing the server to execute requests to arbitrary domains. An attacker authenticated with Subscriber-level privileges can exploit this to scan internal networks, interact with internal services, or bypass firewalls. The vulnerability has been addressed in version 2.8.162.

## Affected products

- Paolo GeoDirectory <= 2.8.161

## Timeline

- 2026-05-16: disclosed: Reported by dodoh4t
- 2026-06-30: advisory: Patchstack published advisory
- 2026-07-02: patched: NVD publication and patch availability confirmed in version 2.8.162

## References

- [https://patchstack.com/database/wordpress/plugin/geodirectory/vulnerability/wordpress-geodirectory-plugin-2-8-161-server-side-request-forgery-ssrf-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/geodirectory/vulnerability/wordpress-geodirectory-plugin-2-8-161-server-side-request-forgery-ssrf-vulnerability?_s_id=cve)