CVE-2026-113491None▾ SunlitThe GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.
GeoDirectory < 2.8.194Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113493NoneGeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute
CVE-2026-113489NoneGeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR
CVE-2026-113490NoneGeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint
CVE-2026-113673NoneGeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export
CVE-2026-113674NoneGeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification
CVE-2026-113492NoneGeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action