Arbitrary File Deletion Vulnerability in GeoDirectory Plugin for WordPress

CVE-2026-19091

What is CVE-2026-19091?

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path validation in its delete_revision function. This vulnerability allows authenticated attackers with subscriber-level access to delete arbitrary files from the server. By manipulating the query string, an attacker can bypass security checks and convert auto-draft listings into WordPress attachments with malicious file paths. This exposure can lead to dangerous outcomes, such as remote code execution, if critical files like wp-config.php are deleted. It's crucial for users to update to the latest version to mitigate this risk.

References