Technical impact
The vulnerability in the GeoDirectory WordPress plugin allows users with Subscriber-level access or higher to supply an image URL that is not properly validated; the plugin uses the supplied value as a local file path when saving a front‑end listing. This leads to a path traversal flaw that can read files outside the web root and, when the file name ends with a permitted media extension, delete the original file on the server. The deletion side effect also republishes the content at a public URL. The flaw is a local compromise that can reveal sensitive files and cause loss of media files, potentially affecting confidentiality and availability of content.
Affected Systems
All installations of GeoDirectory WordPress plugin with versions earlier than 2.8.194 are affected. The vulnerability is present in the plugin code by default for subscribers or higher roles, regardless of additional customizations. No other vendors or products are listed as affected.
Risk and Exploitability
The flaw can be exploited through normal front‑end listing submission or editing functions that accept an image URL. An attacker with Subscriber access can retrieve files that contain media extensions such as .jpg, .png, .gif, etc., and can delete those same files. The CVSS score of 6.4 indicates moderate severity, and the EPSS score of < 1% suggests low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. While there is no publicly disclosed exploit code, the path traversal logic is straightforward, implying a high likelihood of exploitation in environments where the plugin is active and not patched.
