CVE-2026-19091
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). By placing post_type=attachment exclusively in the query string to bypass the consistency check, an attacker can convert an auto-draft GeoDirectory listing into a WordPress attachment with attacker-controlled file paths injected into attachment metadata, which the delete_revision handler then dereferences and unlinks without any post-type or path validation.
Risk Assessment
An authenticated attacker can delete critical files such as wp-config.php, potentially leading to full server compromise and system integrity breach.
Recommendation
It is recommended to immediately update the GeoDirectory plugin to a patched version and restrict user privileges to the minimum necessary.
Other vulnerabilities in GeoDirectory
See all- CVE-2026-66604High
Unauthenticated Cross Site Scripting (XSS) in GeoDirectory versions up to 2.8.173. An attacker can inject malicious script without authentication.
- CVE-2026-84813Critical
Unauthenticated SQL Injection vulnerability in GeoDirectory versions up to 2.8.174. An attacker can inject SQL queries, potentially leading to unauthorized database access.
- CVE-2026-39512Critical
GeoDirectory versions up to 2.8.152 are vulnerable to unauthenticated SQL injection.
- CVE-2026-116752Medium
The GeoDirectory plugin for WordPress (up to and including 2.8.197) is vulnerable to Stored Cross-Site Scripting via the 'post_images' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access and above can inject arbitrary web scripts into pages that will execute when an Administrator or Editor opens the pending listing's edit screen. The payload does not fire for the attacker directly but executes in the victim's browser, enabling privilege escalation.
- CVE-2026-113494Low
The GeoDirectory plugin for WordPress before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes. This allows users with the Contributor role and above to disclose the content and custom fields of other users' draft, pending, private and trashed listings.
- CVE-2026-113488Medium
The GeoDirectory plugin for WordPress before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who clicks the badge, including administrators.
- CVE-2026-113487Medium
The GeoDirectory plugin for WordPress before 2.8.196 does not properly sanitize or escape a post badge click-through link value before outputting it in an anchor element on a listing. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view the listing, including an administrator reviewing moderated content.
- CVE-2026-113674Low
The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited. This allows unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.
- CVE-2026-113673High
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder. This allows high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.
- CVE-2026-113493Medium
The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.
Original NVD description (English source)
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). By placing post_type=attachment exclusively in the query string to bypass the consistency check, an attacker can convert an auto-draft GeoDirectory listing into a WordPress attachment with attacker-controlled file paths injected into attachment metadata, which the delete_revision handler then dereferences and unlinks without any post-type or path validation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS