GeoDirectory WordPress plugin versions before 2.8.194 allow users with Subscriber level or higher to modify the title, caption, moderation status, and featured flag of images that belong to other users' listings, and to claim another user's image as their own featured image, because the plugin does not validate that an attachment belongs to the listing being saved. The flaw permits unauthorized editorial changes to listing images, potentially causing defacement, misinformation, or loss of user trust. An attacker could manipulate image metadata to present misleading content or to control which images appear as featured in listings.

The vulnerability affects the GeoDirectory WordPress plugin (Unknown:GeoDirectory). All installations running a version earlier than 2.8.194 are impacted. Any WordPress site that has the plugin installed with a susceptible version is at risk.

The CVSS score for this issue is not published, and no EPSS score is available, which suggests limited public exploitation data. The flaw requires an authenticated user with Subscriber or higher privileges, so the attack vector is not remote unauthenticated but internal to the site. Because the vulnerability is not listed in CISA KEV, it has not been observed in the wild at the time of this report. Organizations using the affected plugin should treat it as a moderate risk and prioritize remediation, as it could undermine content integrity and client confidence.