CVE-2026-113491GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal
Updated under an hour ago ()
Does this affect you?
It affects Unknown GeoDirectory. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.
- CVSS
- 6.4 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness (CWE)
- CWE-22
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- WPScan
- NVD analysis
- Deferred
- Record last updated
- Oct 24, 2026
- First seen by InfoSec Signals
- Oct 24, 2026
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.