---
id: "CVE-2026-113489"
kind: "vulnerability"
aliases: ["CVE-2026-113489"]
title: "GeoDirectory WordPress plugin lets subscribers alter other users' listing images"
severity: "medium"
cvss: null
epss: 0.0018
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["geodirectory", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-public-registration", "plugin-updated"]
published_at: "2026-10-24T06:16:36+00:00"
first_seen_at: "2026-10-24T06:47:03+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113489", "first_seen_at": "2026-10-24T06:47:03+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-113489", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# GeoDirectory WordPress plugin lets subscribers alter other users' listing images

The GeoDirectory WordPress plugin before 2.8.194 does not check that an attachment belongs to the listing being saved. A logged-in Subscriber can change the title, caption, moderation status and featured flag of other users' listing images and claim them as their own featured image.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GeoDirectory plugin version in the WordPress admin Plugins screen or with `wp plugin get geodirectory --field=version`
- Confirm whether open subscriber registration is enabled under Settings > General > Membership

## Fix

- Update the GeoDirectory plugin to `2.8.194` or later
- unknown whether a workaround exists before updating

## Timeline

- 2026-10-24T06:47:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113489
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-113489

## From the sources

The GeoDirectory  WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_