The GeoDirectory WordPress plugin contains an insecure direct object reference in the post_attachment_upload function. This flaw is caused by a missing validation on a user‑controlled key, allowing authenticated users with author-level permissions or greater to upload and attach any image file to any supported element within the plugin. The attack does not provide remote code execution, data exfiltration, or other direct system compromise, but it does enable a user to alter content that is displayed to site visitors.

WordPress sites that have the GeoDirectory – WP Business Directory Plugin and Classified Listings Directory installed in any version up to and including 2.8.139 are affected. Any site with an author account or higher role that can access the plugin’s upload functionality is vulnerable.

The CVSS score of 4.3 indicates a moderate impact. An EPSS score of less than 1% suggests a very low but non‑zero probability that this vulnerability will be exploited. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires an authenticated session with author or higher privileges, and the attack vector is the authenticated user’s ability to submit a file to the upload endpoint.