Paoltaia · Geodirectory – Wp Business Directory Plugin/Classified Listings Directory · CVE-2026-19091
**Name of the Vulnerable Software and Affected Versions**
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory versions prior to 2.8.170
**Description**
Insufficient file path validation in the `delete revision()` function allows authenticated attackers with subscriber-level access or higher to delete arbitrary files on the server. By placing `post type=attachment` in the query string to bypass consistency checks, an attacker can convert an auto-draft listing into a WordPress attachment. This allows the injection of attacker-controlled file paths into attachment metadata, which the handler then dereferences and unlinks without validation. Deleting critical files, such as `wp-config.php`, can lead to remote code execution.
**Recommendations**
Update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.170 or later.
As a temporary mitigation, restrict access to the `delete revision()` function for users with subscriber-level permissions.