Live › vulnerability › CVE-2026-113491
Go to dashboardThe GeoDirectory WordPress plugin before 2.8.194 uses a user-supplied image URL as a local file path when saving a front-end listing, without validating it. A user with Subscriber-level access or higher can read media files from outside the web root and delete files on the server, limited to names with an allowed media extension.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 06:47 UTC. All times on this page are UTC.
Sites running the GeoDirectory WordPress plugin before 2.8.194 that accept front-end listing submissions from logged-in users with Subscriber access or higher. Sites without the plugin, or on a fixed version, are not affected.
No product ranges from the sources yet.
wp plugin get geodirectory --field=version2.8.194 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.
This page as .md · .json · in your agent: get_signal("CVE-2026-113491")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.