CVE-2026-113491
CVE-2026-113491 · GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.
CVSS 6.4 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
geodirectory
- Versions
- ≥ 0, < 2.8.194: Affected (semver)
Update to 2.8.194