Local File Inclusion Vulnerability in GeoDirectory Business Directory Plugin for WordPress

CVE-2026-104899

What is CVE-2026-104899?

The GeoDirectory WP Business Directory Plugin and the Classified Listings Directory plugin for WordPress are susceptible to a Local File Inclusion vulnerability in all versions up to and including 2.8.187. This vulnerability arises from the exploitation of the 'design_type' parameter, which allows unauthenticated attackers to include and execute arbitrary .php files on the server. As a result, an attacker may bypass access controls, access sensitive information, or execute malicious PHP code. The vulnerability is compounded by the ease of obtaining the necessary nonce value, as it is accessible to any visitor on the public-facing pages of the site. Therefore, immediate remediation is essential for site administrators using the affected versions.

References