WordPress security changelog
HIGH CVE-2026-104899 Deferred

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Filesystem traversal

An unauthenticated caller can supply design_type to a PHP include path using the geodir_basic_nonce exposed in public geodir_params data. This permits local file inclusion and execution of an existing PHP file; arbitrary uploaded code requires a separate way to place it on the server. The supplied vector reports high attack complexity, and the export does not establish a universal standalone takeover. Affected versions: <= 2.8.187. The matching official changelog confirms 2.8.188 as fixed for this CVE.

CVE / CNA score 8.1 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
Plugin slug
geodirectory
Affected
<= 2.8.187
Safe version
2.8.188
Published
Oct 10, 2026
Weakness
CWE-98 — Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

This CVE was published Oct 10, 2026 and is one of 42 known issues for this plugin.

What to do

Update, patch or deactivate.

Update to 2.8.188 or a later supported release. Application-level remediation: Map design choices to a fixed allowlist of trusted templates and reject caller-controlled filesystem paths before including any file.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'design_type' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The required nonce is trivially obtainable by any anonymous visitor, as the geodir_basic_nonce value is localized to every public frontend page via the geodir_params script object, meaning no authentication, user interaction, or specific site content is required to exploit this vulnerability.

CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources