Image Management Flaw in GeoDirectory Plugin for WordPress
CVE-2026-113489
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 24 October 2026
Badges
What is CVE-2026-113489?
The GeoDirectory plugin for WordPress, prior to version 2.8.194, is susceptible to an access control vulnerability. This issue arises because the plugin fails to verify the ownership of attachments associated with listings. As a result, users with Subscriber-level access or higher can alter attributes such as the title, caption, moderation status, and featured flag of images belonging to other users' listings. This flaw creates a risk wherein unauthorized users could claim another user's image as their own featured image, potentially leading to privacy breaches and content misattribution.
Affected Version(s)
GeoDirectory 0 < 2.8.194
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.