GeoDirectory Plugin Unsafe Code Generation Enables RCE

The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-113673 represents a critical privilege escalation and code execution vulnerability in the GeoDirectory WordPress plugin versions before 2.8.194. The plugin fails to properly sanitize administrator-supplied text before injecting it into dynamically generated PHP files stored in its own directory. This creates a two-stage attack: a subsite administrator on a WordPress multisite installation (a user normally restricted from code execution) can inject malicious PHP code through what appears to be a legitimate configuration field. Once written to disk, any unauthenticated visitor triggering the affected functionality executes this injected code with web server privileges. Organizations running multisite WordPress networks with untrusted subsite administrators, or those where account compromise could occur, face direct risk of complete server compromise and data breach.

Casky.ai's 323 mapped security skills detect this attack through MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Resource Development), correlating indicators across the attack chain. Practitioners using Claude AI's extended reasoning will identify: (1) CWE-94 pattern matching—detection of unsanitized user input flowing into file write operations and PHP code generation, (2) behavioral anomalies showing low-privilege users writing PHP files to web-accessible directories, (3) suspicious PHP file creation timestamps correlating with administrator configuration changes, and (4) unauthenticated requests immediately preceding code execution events. Security teams will see findings highlighting the gap between declared user permissions (admin cannot execute code) and actual system capabilities (code execution achieved), flagging this as a privilege boundary bypass requiring immediate patching and audit of recent plugin configuration changes.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-113673.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-113673

Casky has 323 skills that investigate the attack patterns behind CVE-2026-113673. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn