Medium 4.3

The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment...

CVE-2026-113489 First seen on SecPulse Oct 24, 15:00

Affected packages

Ecosystem	Package	Affected	Fixed
CVE	GeoDirectory	< 2.8.194	2.8.194

Original description The description as published by the source.

The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 4.3; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Published: Oct 24, 2026
First seen on SecPulse: Oct 24, 15:00
GHSA: GHSA-cj9g-3xc7-vgw3
CWE: CWE-639

NVD GitHub Advisory

Tags(click for explanation)

Web Frameworks

WordPress

All

CWE-639 Geodirectory

Detection sources

NIST National Vulnerability DatabaseOct 26, 22:50
GitHub Security Advisories (Global)Oct 25, 00:32
CVE.org (CVE Program・cvelistV5)Oct 24, 23:36