GeoDirectory <=2.8.169 Authenticated Arbitrary File Deletion via post_type Bypass (CVE-2026-19091)

Vulnerability Overview Vulnerability Name: GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision CVE ID: CVE-2026-19091 CVSS Score: 8.1 (High) Publication Date: August 11, 2026 Last Updated: August 11, 2026 Researcher: mak3bread Affected Scope Software Type: Plugin Software Name: GeoDirectory – WP Business Directory Plugin and Classified Listings Directory Affected Versions: <= 2.8.169 Fixed Version: 2.8.170 Remediation Recommendation: Update to version 2.8.170 or higher. Vulnerability Description This vulnerability allows an authenticated attacker (with subscriber-level access) to achieve remote code execution by deleting arbitrary files on the server. The attacker can bypass integrity checks by setting in the query string, converting the auto-generated GeoDirectory listing into a WordPress attachment, and deleting files by injecting attacker-controlled file paths. References github.com plugins.trac.wordpress.org Additional Information Recently Discovered Vulnerabilities: - GeoDirectory – WP Business Directory Plugin and Classified Listings Directory contains multiple vulnerabilities, including Server-Side Request Forgery (SSRF), unauthorized access, SQL injection, etc. - For specific vulnerability details and publication dates, see the table on the page. Disclaimer This record contains copyrighted material, the copyright of which belongs to Defiant Inc. and The MITRE Corporation. Contact Information For any errors or if you need more information, please contact: wfi-support@wordfence.com Additional Resources Wordfence Intelligence: Provides free access to the WordPress vulnerability database and API. Wordfence WordPress Plugin: Once installed, it will immediately notify you if your website is affected by the latest vulnerabilities. Footer Information Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Support Response Time: 24-hour support, year-round, with a 1-hour response time Social Media Facebook: [Link] Twitter: [Link] LinkedIn: [Link] Email: [Link] Legal Statements Terms of Service: [Link] Privacy Policy and Collection Notice: [Link] Do Not Sell or Share My Personal Information: [Link] Products and Support Wordfence Free: [Link] Wordfence Premium: [Link] Wordfence Care: [Link] Wordfence Response: [Link] Wordfence CLI: [Link] Wordfence Intelligence: [Link] Wordfence Central: [Link] News and Updates Blog: [Link] Latest News: [Link] Vulnerability Advisories: [Link] About About Wordfence: [Link] Affiliate Program: [Link] Careers: [Link] Contact: [Link] Security: [Link] CVE Request Form: [Link] Subscribe to Updates Subscribe to News and Updates: [Link] Copyright Statement © 2012-2026 Defiant Inc. All rights reserved. Others Wordfence Intelligence: [Link] Wordfence WordPress Plugin: [Link] Wordfence WordPress Vulnerability Database: [Link] Disclaimer This record contains copyrighted material, the copyright of which belongs to Defiant Inc. and The MITRE Corporation. Contact Information For any errors or if you need more information, please contact: wfi-support@wordfence.com Additional Resources Wordfence Intelligence: Provides free access to the WordPress vulnerability database and API. Wordfence WordPress Plugin: Once installed, it will immediately notify you if your website is affected by the latest vulnerabilities. Footer Information Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Support Response Time: 24-hour support, year-round, with a 1-hour response time Social Media Facebook: [Link] Twitter: [Link] LinkedIn: [Link] Email: [Link] Legal Statements Terms of Service: [Link] Privacy Policy and Collection Notice: [Link] Do Not Sell or Share My Personal Information: [Link] Products and Support Wordfence Free: [Link] Wordfence Premium: [Link] Wordfence Care: [Link] Wordfence Response: [Link] Wordfence CLI: [Link] Wordfence Intelligence: [Link] Wordfence Central: [Link] News and Updates Blog: [Link] Latest News: [Link] Vulnerability Advisories: [Link] About About Wordfence: [Link] Affiliate Program: [Link] Careers: [Link] Contact: [Link] Security: [Link] CVE Request Form: [Link] Subscribe to Updates Subscribe to News and Updates: [Link] Copyright Statement © 2012-2026 Defiant Inc. All rights reserved. Others Wordfence Intelligence: [Link] Wordfence WordPress Plugin: [Link] Wordfence WordPress Vulnerability Database: [Link] Disclaimer This record contains copyrighted material, the copyright of which belongs to Defiant Inc. and The MITRE Corporation. Contact Information For any errors or if you need more information, please contact: wfi-support@wordfence.com Additional Resources Wordfence Intelligence: Provides free access to the WordPress vulnerability database and API. Wordfence WordPress Plugin: Once installed, it will immediately notify you if your website is affected by the latest vulnerabilities. F

Goal Reached Thanks to every supporter — we hit 100%!

GeoDirectory <=2.8.169 Authenticated Arbitrary File Deletion via post_type Bypass (CVE-2026-19091)

More from this source