Security readout for executives and security teams
Plain-English summary
GeoDirectory versions through 2.8.174 are reported vulnerable to SQL injection without authentication. An internet attacker may be able to access sensitive WordPress database information and cause limited disruption. The supplied assessment rates it 9.3 critical, but provides no confirmed exploitation evidence or named fixed version.
Executive priority
Address immediately on internet-facing WordPress systems because exploitation requires no account or user action and may expose sensitive database information. Prioritize asset discovery, temporary containment, and vendor-confirmed remediation. Do not claim compromise solely from the severity rating; investigate telemetry for evidence.
Technical view
CVE-2026-84813 is a CWE-89 SQL injection affecting GeoDirectory through 2.8.174. The CVSS 3.1 vector indicates remote, low-complexity exploitation requiring neither privileges nor user interaction, with high confidentiality impact, no integrity impact, limited availability impact, and changed scope. The bundle does not identify the vulnerable endpoint or injection mechanism.
Likely exposure
Highest exposure exists on publicly reachable WordPress sites running GeoDirectory 2.8.174 or earlier. Risk depends on whether the vulnerable plugin functionality is installed and reachable. The bundle contains inconsistent affected-product metadata—its description names the vulnerable range, while the structured version field says “n/a” and default status “unaffected”—so verify deployments carefully.
Exploitation context
The vulnerability is described as remotely exploitable without authentication and requiring low complexity. However, it is not listed in the supplied KEV data, and the provided sources do not establish active exploitation, public exploit availability, attack volume, or observed compromises.
Researcher notes
The record identifies CWE-89 and CVSS 9.3, but supplies no affected endpoint, parameters, root cause, proof of concept, fixed version, or exploitation telemetry. Structured affected-version metadata conflicts with the narrative range. Validation should remain non-destructive and focus on inventory, reachability, version confirmation, vendor advisories, and defensive telemetry.
Mitigation direction
- Inventory every WordPress deployment using GeoDirectory and prioritize internet-facing instances.
- Consult GeoDirectory and Patchstack guidance for a fixed release; the source bundle names no fix.
- Until remediation is confirmed, disable the plugin where operationally acceptable.
- Otherwise, restrict public access and apply monitored web filtering as temporary compensating controls.
- Preserve current logs and backups before making remediation changes.
Validation and detection
- Confirm the installed GeoDirectory version on every WordPress instance.
- Treat versions through 2.8.174 as potentially vulnerable pending authoritative vendor clarification.
- Verify any replacement version against current GeoDirectory or Patchstack guidance.
- Review web, application, and database logs for unusual unauthenticated requests or SQL errors.
- After remediation, confirm the plugin version and reassess external reachability without attempting exploitation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-84813 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L3.94.7PatchstackVulnerability scoring details
Base CVSS 3.1 score
9.3CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://patchstack.com/database/wordpress/plugin/geodirectory/vulnerability/wordpress-geodirectory-plugin-2-8-174-sql-injection-vulnerability?_s_id=cveCVE reference, Patchstack · vdb-entry
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.