[ CVE-2026-113489 · Published 24 Oct 2026 ]
Vulnerability in Unknown GeoDirectory
CVSS 4.3
EPSS <1%No fix listed yet
[ Description ]Official description
The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.