What the vulnerability does
01Description
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). By placing post_type=attachment exclusively in the query string to bypass the consistency check, an attacker can convert an auto-draft GeoDirectory listing into a WordPress attachment with attacker-controlled file paths injected into attachment metadata, which the delete_revision handler then dereferences and unlinks without any post-type or path validation.
Explanation of Vulnerability in Simple Terms
02Summary
GeoDirectory versions up to 2.8.169 contain a path traversal vulnerability that allows authenticated users to modify or delete files on the site. An attacker with a low-privilege account can bypass file access restrictions and manipulate the site's file system, potentially corrupting data or disabling functionality. Update to a version newer than 2.8.169 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Modify or delete files on the site's server using path traversal techniques.
Potential impact on your site
04Site Impact
Site files can be corrupted, deleted, or modified by any authenticated user, potentially breaking functionality or exposing sensitive data.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site; no user interaction required.
Key dates
06Disclosure timeline
August 11, 2026
CVE published
