UNKNOWN NVD

CVE-2026-113489

The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscribe

The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.

References

https://wpscan.com/vulnerability/2f539d43-6f95-494f-b399-21697145591e/

Published: 2026-10-24 · Source: NVD · Feed updated: 2026-10-24

This unknown severity vulnerability was published on 2026-10-24 via NVD.

vulnfeed aggregates 15883 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.