EUVD-2026-56929
GHSA-7gmf-8rwv-m7jc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network AJAX endpoint, subscriber-level auth enforces PR:L, no special conditions for AC:L, file deletion yields I:H and A:H with no direct confidentiality exposure.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
3DescriptionCVE.org
The GeoDirectory - WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). By placing post_type=attachment exclusively in the query string to bypass the consistency check, an attacker can convert an auto-draft GeoDirectory listing into a WordPress attachment with attacker-controlled file paths injected into attachment metadata, which the delete_revision handler then dereferences and unlinks without any post-type or path validation.
Articles & Coverage 2
AnalysisAI
Arbitrary file deletion in the GeoDirectory WordPress plugin (all versions through 2.8.169) permits authenticated attackers with subscriber-level access to delete any file the web server process can reach, trivially enabling remote code execution by targeting wp-config.php. The attack exploits a query-string consistency-check bypass in the delete_revision handler, which dereferences attacker-supplied attachment metadata paths without any post-type or filesystem-path validation. No public exploit code or CISA KEV listing was identified at time of analysis, though the description is sufficiently detailed to enable independent exploit development; any site with open user registration should treat this as an immediate priority.
Technical ContextAI
The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) within the GeoDirectory plugin's delete_revision function in includes/class-geodir-post-data.php (lines 1321-1326 and 1502-1550). WordPress's auto-save and revision flow normally restricts post-type handling to GeoDirectory-specific post types, but an attacker can place post_type=attachment exclusively in the HTTP query string rather than the POST body, bypassing the intra-request consistency check. This coerces an auto-draft GeoDirectory listing into a WordPress attachment object, after which the attacker can write arbitrary filesystem paths into attachment metadata fields. When delete_revision is subsequently invoked, it calls PHP's unlink() on the stored path without verifying the post type, validating that the path falls within an expected directory, or checking ownership. The GitHub PR #3070 patch (https://github.com/AyeCode/geodirectory/pull/3070) adds post-type validation at every entry point (init_gd_post, wp_insert_post_data, auto_save_post, ajax_save_post, and delete_revision itself) and strips reserved metadata fields meta_input and guid to prevent metadata injection.
RemediationAI
Update the GeoDirectory plugin to the version incorporating WordPress.org changeset 3638028 (https://plugins.trac.wordpress.org/changeset/3638028/geodirectory), which adds post-type validation at all affected entry points and strips reserved metadata fields; the exact released version number post-fix is not confirmed in the provided data but is greater than 2.8.169. If an immediate update is not possible, disable open WordPress user registration (Settings > General > uncheck 'Anyone can register') to deny attackers a path to subscriber accounts - this removes the exploitation prerequisite but does not remediate the underlying flaw and any existing subscriber-level accounts remain a threat vector. As an additional compensating control, a web application firewall rule blocking AJAX requests where the query string contains post_type=attachment to GeoDirectory endpoint handlers can disrupt the bypass technique, though rule precision is required to avoid breaking legitimate attachment workflows. Sites using Wordfence may receive protection via firewall rules published alongside the threat intelligence entry. The Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/e4fb4127-2b3f-4c8c-95ee-611f1bacf4c5) should be monitored for updated guidance.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today