{"id":"CVE-2026-113489","kind":"vulnerability","aliases":["CVE-2026-113489"],"related":[],"title":"GeoDirectory WordPress plugin lets subscribers alter other users' listing images","description":"The GeoDirectory  WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not check that an attachment belongs to the listing being saved. A logged-in Subscriber can change the title, caption, moderation status and featured flag of other users' listing images and claim them as their own featured image.","severity":"medium","cvss":null,"epss":0.0018,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["geodirectory","package","self-hosted","wordpress"],"not_affected_if":["no-public-registration","plugin-updated"],"how_to_check":"- Check the installed GeoDirectory plugin version in the WordPress admin Plugins screen or with `wp plugin get geodirectory --field=version`\n- Confirm whether open subscriber registration is enabled under Settings > General > Membership","fix":"- Update the GeoDirectory plugin to `2.8.194` or later\n- unknown whether a workaround exists before updating","status":"open","published_at":"2026-10-24T06:16:36+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","triaged_at":"2026-10-25T04:51:56+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:51:56Z","model":"claude-haiku-5-5","output":{"fix":"- Update the GeoDirectory plugin to `2.8.194` or later\n- unknown whether a workaround exists before updating","reach":"internet","title":"GeoDirectory WordPress plugin lets subscribers alter other users' listing images","impact":"medium","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not check that an attachment belongs to the listing being saved. A logged-in Subscriber can change the title, caption, moderation status and featured flag of other users' listing images and claim them as their own featured image.","category":"package","nicknames":[],"who_cares":["wordpress","geodirectory","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker alters other users' listing images and featured images","analyst_note":"","how_to_check":"- Check the installed GeoDirectory plugin version in the WordPress admin Plugins screen or with `wp plugin get geodirectory --field=version`\n- Confirm whether open subscriber registration is enabled under Settings > General > Membership","needs_analyst":false,"not_affected_if":["plugin-updated","no-public-registration"],"who_is_affected":"Sites running GeoDirectory before `2.8.194` that let users register or hold Subscriber-level accounts and submit listings with images. Sites without public registration or without GeoDirectory listings can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000587,"input_tokens":3322,"output_tokens":509,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113489':13A,16A '-2026':12A,15A '2.8.194':28B,74C 'access':94C 'allow':88C 'alter':6A 'anoth':117C 'attach':34B,81C 'belong':35B,82C,109C 'caption':50B,101C 'chang':47B 'check':31B 'claim':62B,116C 'cve':11A,14A 'featur':54B,67B,105C,124C 'flag':55B,106C 'geodirectori':1A,17B,24B,70C 'host':21B 'imag':10A,60B,68B,108C,120C,125C 'let':4A 'level':93C 'list':9A,38B,59B,85C,113C 'log':43B 'logged-in':42B 'moder':51B,102C 'modifi':98C 'packag':18B 'plugin':3A,26B,72C 'referenc':80C 'save':40B,87C 'self':20B 'self-host':19B 'status':52B,103C 'subscrib':5A,45B,92C 'subscriber-level':91C 'titl':49B,100C 'user':8A,58B,89C,112C,118C 'verifi':77C 'wordpress':2A,22B,25B,71C","nicknames":[],"mitigations":[],"who_affected":"Sites running GeoDirectory before `2.8.194` that let users register or hold Subscriber-level accounts and submit listings with images. Sites without public registration or without GeoDirectory listings can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T06:16:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113489","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113489","severity":null,"published_at":"2026-10-24T06:16:36+00:00","modified_at":"2026-10-24T06:16:36+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","fetched_at":"2026-10-24T06:47:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-113489","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113489","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}