CVE-2026-19091

Name of the Vulnerable Software and Affected Versions GeoDirectory – WP Business Directory Plugin and Classified Listings Directory versions prior to 2.8.170

Description Insufficient file path validation in the delete revision() function allows authenticated attackers with subscriber-level access or higher to delete arbitrary files on the server. By placing post type=attachment in the query string to bypass consistency checks, an attacker can convert an auto-draft listing into a WordPress attachment. This allows the injection of attacker-controlled file paths into attachment metadata, which the handler then dereferences and unlinks without validation. Deleting critical files, such as wp-config.php, can lead to remote code execution.

Recommendations Update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.170 or later. As a temporary mitigation, restrict access to the delete revision() function for users with subscriber-level permissions.