The vulnerability allows authenticated users with subscriber‑level permissions to delete arbitrary files on the server by exploiting a lack of validation in the delete_revision function. An attacker can craft a query string that sets "post_type" to "attachment", turning a GeoDirectory listing into a WordPress attachment with a user‑supplied file path. The delete_revision handler then unlinks the specified file without checking the path or post type, enabling deletion of critical files such as wp-config.php. This weakness is a form of path traversal and is classified as CWE‑22, and can lead to remote code execution if malicious files are removed or replaced.

The issue affects the GeoDirectory – WP Business Directory Plugin (also known as Classified Listings Directory) for WordPress from all releases up through version 2.8.169. The affected vendor is paoltaia, and the plugin is distributed under the GeoDirectory name. Anyone running the plugin on a WordPress site with subscriber or higher roles is potentially vulnerable until the plugin is updated to a version newer than 2.8.169.

The CVSS score of 8.1 indicates high severity, and the vulnerability can lead to remote code execution if critical files such as wp-config.php are deleted or overridden. The EPSS score of less than 1 % suggests that exploitation is uncommon in the short term. Exploitation requires an authenticated user with subscriber or higher role and the ability to send a crafted query string, so the attack vector is likely internal or via compromised credentials. Once the conditions are met, the lack of path validation makes the vulnerability relatively easy to exploit, enabling the removal of arbitrary files on the server, which can directly lead to RCE if files controlling application logic are targeted.