CVE-2026-104899: GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'designtype' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The required nonce is trivially obtainable by any anonymous visitor, as the geodirbasicnonce value is localized to every public frontend page via the geodirparams script object, meaning no authentication, user interaction, or specific site content is required to exploit this vulnerability.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Any site running GeoDirectory version 2.8.187 or earlier is exposed. Exploitation can be performed remotely by an unauthenticated visitor and does not require user interaction or specific site content.
Does the nonce prevent unauthenticated exploitation?
No. The required geodir_basic_nonce is available to anonymous visitors because it is localized on every public frontend page through the geodir_params script object.
What does an attacker need to achieve code execution?
The attacker needs a PHP file already present on the server that can be included through the vulnerable parameter. If PHP file types can be uploaded and then included, the issue can lead to execution of PHP code from those files.
How can I determine whether my site is affected?
Check the installed GeoDirectory version. Versions up to and including 2.8.187 are affected.