CVE-2025-12833: GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.8.139 via the 'postattachmentupload' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to attach arbitrary image files to arbitrary places.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12833?
CVE-2025-12833 is classified as a medium-severity vulnerability due to its potential for unauthorized access to user-uploaded files.
How do I fix CVE-2025-12833?
To fix CVE-2025-12833, update the GeoDirectory WP Business Directory Plugin and Classified Listings Directory to the latest version that is beyond 2.8.139.
What versions of the GeoDirectory plugin are affected by CVE-2025-12833?
CVE-2025-12833 affects all versions of the GeoDirectory WP Business Directory Plugin and Classified Listings Directory up to and including 2.8.139.
What type of vulnerability is CVE-2025-12833?
CVE-2025-12833 is characterized as an Insecure Direct Object Reference vulnerability, allowing unauthorized access to files.
What is the impact of CVE-2025-12833?
The impact of CVE-2025-12833 includes the potential exposure of sensitive user data through improper validation in file uploads.