CVE-2026-113491: GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal

Q: Which accounts can exploit this issue?

Any authenticated user with Subscriber-level access or higher can exploit it through front-end listing submission. No administrative privileges are required.

Q: What can an attacker access or modify?

An attacker can use a crafted image URL to reference files outside the web root, provided the target filename has an allowed media extension. The referenced file is republished at a public URL, and the original file is deleted as a side effect.

Q: How can I tell whether exploitation may have occurred?

Review publicly accessible media for unexpected copies of server files and investigate missing files with allowed media extensions. Front-end listings containing suspicious image URLs or paths should also be examined.

Published Oct 24, 2026

Updated

The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.

Affected Software

1 affected component

GeoDirectory GeoDirectory<2.8.194

Event History

Oct 24, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which accounts can exploit this issue?

Any authenticated user with Subscriber-level access or higher can exploit it through front-end listing submission. No administrative privileges are required.

What can an attacker access or modify?

An attacker can use a crafted image URL to reference files outside the web root, provided the target filename has an allowed media extension. The referenced file is republished at a public URL, and the original file is deleted as a side effect.

How can I tell whether exploitation may have occurred?

Review publicly accessible media for unexpected copies of server files and investigate missing files with allowed media extensions. Front-end listings containing suspicious image URLs or paths should also be examined.