CVE-2026-113489
GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.
| Vendor | unknown |
| Product | geodirectory |
| Published | Oct 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown geodirectory
Be the first to know when new unknown vulnerabilities affecting unknown geodirectory are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / GeoDirectory
0 < 2.8.194
References
Credits
Karthik Ramakrishnan WPScan