GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter
- ID
- WPSEC-2026-0379
- Plugin
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (geodirectory)
- Affected
- from 2.8.103 before 2.8.188
- Remediation
- Update to 2.8.188 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-98
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- GeoDirectory on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-104899, on 2026-10-09.
Description
The GeoDirectory plugin for WordPress is vulnerable to Local File Inclusion via the 'design_type' parameter of the GD > Tags widget in versions 2.8.103 up to, and including, 2.8.187. The value is used to build a template path without validation, and the template loader does not reject directory traversal sequences. The widget's AJAX handler is registered for unauthenticated users and is protected only by a nonce that is exposed on public pages, so unauthenticated attackers can include and execute arbitrary .php files on the server on sites where at least one listing tag exists. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php files can be uploaded or otherwise placed on the server. Users with contributor-level access and above can also supply the value through the widget's shortcode.
References
- https://wpsec.com/vuln/WPSEC-2026-0379/
- https://plugins.svn.wordpress.org/geodirectory/tags/2.8.188/
- https://wordpress.org/plugins/geodirectory/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS