GeoDirectory <= 2.8.193 - Authenticated (Subscriber+) Limited Arbitrary File Deletion via Path Traversal in Listing Media
- ID
- WPSEC-2026-1390
- Plugin
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (geodirectory)
- Affected
- all versions before 2.8.194
- Remediation
- Update to 2.8.194 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
- Weakness
- CWE-22
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-21
- Attack surface
- GeoDirectory on WPSec AttackSurface
- Fix released
- Published
Description
The GeoDirectory plugin for WordPress is vulnerable to Path Traversal via listing image and file field URLs in all versions up to, and including, 2.8.193. This is due to the get_external_media function turning a geodir_temp URL into a filesystem path with a plain string replacement that does not block '../' sequences. The resolved file is then moved into the uploads directory and unlinked. This makes it possible for authenticated attackers, with Subscriber-level access and above, who can submit listings to delete files outside the temporary folder, and to copy them onto their own listing. Only files whose extension is allowed for the field can be targeted (image types by default), such as media uploaded by other users.
References
- https://wpsec.com/vuln/WPSEC-2026-1390/
- https://plugins.svn.wordpress.org/geodirectory/tags/2.8.194/
- https://wordpress.org/plugins/geodirectory/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS