{
 "id": "WPSEC-2026-1390",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1390/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1390/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1390/index.md",
 "title": "GeoDirectory <= 2.8.193 - Authenticated (Subscriber+) Limited Arbitrary File Deletion via Path Traversal in Listing Media",
 "description": "The GeoDirectory plugin for WordPress is vulnerable to Path Traversal via listing image and file field URLs in all versions up to, and including, 2.8.193. This is due to the get_external_media function turning a geodir_temp URL into a filesystem path with a plain string replacement that does not block '../' sequences. The resolved file is then moved into the uploads directory and unlinked. This makes it possible for authenticated attackers, with Subscriber-level access and above, who can submit listings to delete files outside the temporary folder, and to copy them onto their own listing. Only files whose extension is allowed for the field can be targeted (image types by default), such as media uploaded by other users.",
 "plugin": {
  "slug": "geodirectory",
  "name": "GeoDirectory",
  "full_name": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory",
  "wordpress_org": "https://wordpress.org/plugins/geodirectory/",
  "advisories_url": "https://wpsec.com/vuln/plugin/geodirectory/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/geodirectory"
 },
 "type": "FILE DELETION",
 "cwe": [
  "CWE-22"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.6,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.8.194",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.8.194"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.8.194",
 "remediation": "Update to 2.8.194 or later.",
 "fix_released": "2026-10-20T17:17:09+00:00",
 "published": "2026-10-21T17:49:01+00:00",
 "updated": "2026-10-21T10:34:26.900159+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1390/",
  "https://plugins.svn.wordpress.org/geodirectory/tags/2.8.194/",
  "https://wordpress.org/plugins/geodirectory/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/geodirectory",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}