CVE-2026-19091

Deferred Deferred - Pending Action

Arbitrary File Deletion in GeoDirectory WordPress Plugin

Publication date: 2026-08-11

Last updated on: 2026-08-13

Assigner: Wordfence

Description

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). By placing post_type=attachment exclusively in the query string to bypass the consistency check, an attacker can convert an auto-draft GeoDirectory listing into a WordPress attachment with attacker-controlled file paths injected into attachment metadata, which the delete_revision handler then dereferences and unlinks without any post-type or path validation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-13

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-19091

EUVD

EUVD-2026-56929

Affected Vendors & Products

Vendor	Product	Version / Range
ayecode	geodirectory	to 2.8.169 (inc)
ayecode	geodirectory	2.8.170

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability in the GeoDirectory WordPress plugin allows authenticated attackers with subscriber-level access or higher to delete arbitrary files on the server due to insufficient file path validation in the delete_revision function. Attackers can exploit this by manipulating file paths in attachment metadata, potentially leading to remote code execution if critical files like wp-config.php are deleted.

Detection Guidance

To detect this vulnerability, check if your GeoDirectory plugin version is 2.8.169 or lower. Inspect WordPress logs for unauthorized file deletion attempts or suspicious AJAX requests. Look for patterns like post_type=attachment in query strings or attempts to modify attachment metadata.

Impact Analysis

An attacker could delete important files, leading to site compromise or complete loss of functionality. They might also execute arbitrary code by targeting specific files. The vulnerability requires low-level access but can escalate to severe impacts like site takeover or data breaches.

Compliance Impact

This vulnerability allows authenticated attackers to delete arbitrary files on the server, including critical files like wp-config.php. Such unauthorized file deletion could lead to unauthorized access, data loss, or remote code execution, which directly violates compliance requirements under GDPR (data protection) and HIPAA (protected health information). Unauthorized file manipulation risks exposing sensitive user data or system configurations, leading to potential regulatory breaches and penalties.

Mitigation Strategies

Immediately update the GeoDirectory plugin to version 2.8.170 or later. Disable the plugin if an update is not available. Review user roles and permissions to ensure only trusted users have subscriber-level access or higher. Monitor for any signs of compromise, such as missing or altered files.

Hi! I’m here to help you understand CVE-2026-19091. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70