CVE-2026-113489 in GeoDirectory Plugin
Summary
by MITRE • 10/24/2026
The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/24/2026
The vulnerability identified in GeoDirectory versions prior to 2.8.194 represents a critical failure in object-level access control within the WordPress plugin ecosystem. This flaw stems from an insufficient verification mechanism when processing attachment metadata updates for property listings. Specifically, the application logic fails to validate that the media item being modified is actually associated with the specific listing entity currently under edit by the authenticated user. Instead of binding the permission check strictly to the ownership or association of the target resource, the system relies on a broader context that allows any authorized user to manipulate attachment properties regardless of their actual relationship to the data object. This architectural oversight creates a direct pathway for unauthorized modification and theft of digital assets within the platform's listing management interface.
From a technical perspective, this issue is classified as an Insecure Direct Object Reference (IDOR), which corresponds to CWE-639 in the Common Weakness Enumeration standard. The vulnerability allows users with Subscriber-level access or higher to bypass intended restrictions by directly manipulating HTTP requests that update attachment metadata. By altering parameters related to title, caption, moderation status, and featured flags, an attacker can effectively hijack visual assets belonging to other listings. This is not merely a cosmetic issue; it involves the modification of critical attributes such as the moderation state, which could be used to bypass content filters or manipulate how images are displayed in search results and public-facing pages. Furthermore, the ability to claim another user's image as their own featured image constitutes an unauthorized action that disrupts data integrity and ownership attribution within the application.
The operational impact of this vulnerability extends beyond simple asset theft. It enables a form of content spoofing where malicious actors can associate inappropriate or misleading images with legitimate listings by altering captions and titles, potentially damaging the reputation of listing owners. Additionally, manipulating moderation status could allow attackers to promote unapproved content or suppress approved content, thereby undermining the administrative controls intended to maintain platform quality. For users relying on GeoDirectory for business operations, this lack of isolation between user-generated assets creates significant trust issues and potential liability if their brand imagery is misused or defaced by other subscribers. The vulnerability effectively turns a collaborative listing platform into an environment where visual identity can be stolen or vandalized with minimal effort from any registered account holder.
Mitigation strategies must focus on implementing strict ownership verification at the application logic layer before processing any metadata updates. Developers should ensure that every request to modify attachment properties includes a server-side check confirming that the current user has explicit permission over both the listing and the specific attachment ID being modified. This involves querying the database to verify the foreign key relationship between the post meta data of the listing and the parent_post_id or similar association fields in the attachments table. Until an official patch is applied, administrators should consider restricting file upload capabilities for lower-privileged user roles if feasible, although this may impact legitimate functionality. The most effective remediation remains upgrading to GeoDirectory version 2.8.194 or later, where these access control checks have been corrected to enforce proper object-level security boundaries.
This vulnerability aligns with the MITRE ATT&CK technique T1078, specifically regarding valid accounts and unauthorized access patterns within web applications. It highlights the importance of enforcing least privilege principles not just for administrative functions but also for standard user interactions involving media management. Security audits should prioritize verifying that all write operations on shared resources include rigorous identity and ownership validation to prevent similar IDOR flaws in future development cycles.