CVE-2026-113673 | CVSS: 7.2 | 严重级别: HIGH
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.
参考链接:
• https://wpscan.com/vulnerability/7ef117ed-1fd6-48e6-b242-87a7b65d3477/
📌 数据来源: NVD 官方
⚠️ 合规声明: 本文内容仅用于网络安全合规学习、科研与授权测试用途。严禁用于任何未授权行为,违者自行承担全部法律责任。