GeoDirectory revision handling lets Subscribers delete arbitrary files
GeoDirectory through 2.8.169 exposes the geodir_auto_save_post and geodir_delete_revision AJAX actions with a geodir-save-post nonce. A Subscriber can place post_type=attachment only in the query string to bypass a check that inspects POST while the handlers consume the combined request. The attacker can convert an owned GeoDirectory auto-draft into an attachment and inject file paths into attachment metadata; later GeoDir_Post_Data::delete_revision() and wp_delete_post() dereference those paths and unlink the files. The exact attachment metadata subkeys are not disclosed.
- Component
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Plugin slug
geodirectory- Affected
- <= 2.8.169
- Safe version
2.8.170- Published
- Aug 11, 2026
This CVE was published Aug 11, 2026 and is one of 42 known issues for this plugin.
Update, patch or deactivate.
Update to 2.8.170 or later immediately. Review Subscriber-level GeoDirectory AJAX requests and attachment metadata, restore deleted files from a known-good backup, and investigate unexpected configuration or application failures.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). By placing post_type=attachment exclusively in the query string to bypass the consistency check, an attacker can convert an auto-draft GeoDirectory listing into a WordPress attachment with attacker-controlled file paths injected into attachment metadata, which the delete_revision handler then dereferences and unlinks without any post-type or path validation.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H