6.4
Medium
CVE-2026-113491 The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local…
Description
The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| GeoDirectory 2.8 | earliest → < 2.8.194 | 2.8.194 |
Other CVEs of GeoDirectory
The 17 CVEs of GeoDirectory →
CVE-2026-114270
The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing,…
5.3
Medium
CVE-2026-113494
The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a…
2.7
Low
CVE-2026-113488
The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a…
6.8
Medium
CVE-2026-113487
The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link…
6.8
Medium