$PATCH CAsoon

Advisory feed · Saturday, 24 October 20264,531 CVEs published in the last 7 daysSource: saved copy of NVD from 24 Oct (NVD isn’t answering)Advisory feedDemo · pretend coins and SOL. The CVE records are real.

TLP:CLEARReceivedPublished 24 Oct 2026 · Updated 24 Oct 2026

CVE-2026-113673

·Not scored yetNo CVSS score yet

The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.

No CVSS vector yet. NVD or the CNA hasn’t scored this record.

Affected software: GeoDirectory
Versions: before 2.8.194
Weakness: Not stated
Assigned by: wpscan.com
NVD status: Received

ReferencesNVD https://nvd.nist.gov/vuln/detail/CVE-2026-113673 CVE.org https://www.cve.org/CVERecord?id=CVE-2026-113673 https://wpscan.com/vulnerability/7ef117ed-1fd6-48e6-b242-87a7b65d3477/

The record above is NVD’s, word for word, as read before NVD finished its analysis. Coins say nothing about the flaw.

Launch a coin on CVE-2026-113673

Coins filed under CVE-2026-113673

No coins filed yet.

Be the first to file a coin under CVE-2026-113673.

File the first coin

CVE-2026-113673 · Patch Day