CVE-2026-104899

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'design_type' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The required nonce is trivially obtainable by any anonymous visitor, as the geodir_basic_nonce value is localized to every public frontend page via the geodir_params script object, meaning no authentication, user interaction, or specific site content is required to exploit this vulnerability.

• CWE-98

• https://github.com/AyeCode/geodirectory/commit/2357d640dad7973988742a6706b3a857b6b05d52
• https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.187/includes/class-geodir-ajax.php#L709
• https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.187/includes/template-functions.php#L143
• https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.187/includes/template-functions.php#L199
• https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.187/includes/widgets/class-geodir-widget-tags.php#L1064
• https://plugins.trac.wordpress.org/changeset/3725126/geodirectory/trunk/includes/widgets/class-geodir-widget-tags.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ac817587-1403-46e2-84bf-be5fcadc5425?source=cve

Published

Oct 10, 2026

Last Modified

Oct 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104890Kunstmaan CMS is an open source content management system ba…7.2
• CVE-2026-104891mppx-condition-gate provides conditional free-access wrapper…7.5
• CVE-2026-104892Plane is an open-source project management tool. Prior to 1.…8.7
• CVE-2026-104893Plane is an open-source project management tool. Prior to 1.…5.4
• CVE-2026-104894Plane is an open-source project management tool. Prior to 1.…4.3
• CVE-2026-104898The Online Scheduling and Appointment Booking System – Bookl…6.8
• CVE-2026-1049A security vulnerability has been detected in LigeroSmart up…5.4
• CVE-2026-104900MISP contains a stored cross-site scripting (XSS) vulnerabil…5.3
• CVE-2026-104901MISP contains a cross-site scripting (XSS) vulnerability in …5.1
• CVE-2026-104905FacturaScripts before version 2026.7 contains a PHP object i…8.1
• CVE-2026-104906MISP contains a cross-site scripting (XSS) vulnerability in …6.2
• CVE-2026-104907MISP contains a cross-site scripting (XSS) vulnerability in …4.8