GeoDirectory EUVD-2026-109221

Requires an authenticated account at Subscriber level or above on a WordPress site running GeoDirectory before 2.8.194 (PR:L), so either open user registration or an otherwise-obtained low-privilege account is a prerequisite. The attacker must use the plugin's front-end listing save feature and supply an image URL that the plugin consumes as a local filesystem path without validation. Exploitation is constrained to files whose names carry an allowed media extension, which limits which targets can be read or deleted; no victim interaction is needed (UI:N). The compromise is twofold: the targeted file is re-published at a public URL (disclosure) and its original is deleted (destruction) as a direct side effect of the same operation.

This is a medium-severity, authenticated path traversal (CWE-22) in the GeoDirectory WordPress plugin, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) describes a network-reachable, low-complexity flaw that nonetheless requires authentication - PR:L maps to the Subscriber-level account the description names, so this is not a pre-auth mass-exploitation candidate. EPSS is low (0.20%, 10th percentile), the CVE is NOT listed in CISA KEV, and the exploit signal is only a WPScan reference that is not verified as working exploit code, so there is no evidence of active exploitation - this is a real but moderate priority, matching the vuln.today 'this_month' decision label rather than an emergency. The scope change (S:C) and dual read/delete impact raise its importance above a trivial info leak: an attacker can both exfiltrate files from outside the web root and destroy files, which is why the limited C:L/I:L still aggregates to 6.4. Net: a genuine issue to patch on a normal cycle, gated by the need for a valid low-privilege account, not a high-CVSS-but-low-real-risk false alarm nor a drop-everything zero-day.

An attacker who holds or registers a Subscriber-level account on a WordPress site running GeoDirectory before 2.8.194 saves a front-end listing while supplying a crafted image URL that the plugin treats as a local file path. Because the path is not validated, the attacker reads a sensitive file from outside the web root (it is then re-published at a public URL) and, as a side effect, the original file is deleted - achieving both disclosure and destruction, limited to filenames carrying an allowed media extension. A public PoC reference exists via WPScan but is not verified as working exploit code.