Live › vulnerability › CVE-2026-113489
Go to dashboardThe GeoDirectory WordPress plugin before 2.8.194 does not check that an attachment belongs to the listing being saved. A logged-in Subscriber can change the title, caption, moderation status and featured flag of other users' listing images and claim them as their own featured image.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 06:47 UTC. All times on this page are UTC.
Sites running GeoDirectory before 2.8.194 that let users register or hold Subscriber-level accounts and submit listings with images. Sites without public registration or without GeoDirectory listings can skip it.
No product ranges from the sources yet.
wp plugin get geodirectory --field=version2.8.194 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.
This page as .md · .json · in your agent: get_signal("CVE-2026-113489")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.