Unrated severityNVD Advisory· Published Oct 24, 2026

CVE-2026-113489

Description

The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Geodirectoryllm-fuzzy
Range: <2.8.194
Package: https://wordpress.org/plugins/geodirectory

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/2f539d43-6f95-494f-b399-21697145591e/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000