CVE-2026-19091

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). By placing post_type=attachment exclusively in the query string to bypass the consistency check, an attacker can convert an auto-draft GeoDirectory listing into a WordPress attachment with attacker-controlled file paths injected into attachment metadata, which the delete_revision handler then dereferences and unlinks without any post-type or path validation.

• CWE-22

• https://github.com/AyeCode/geodirectory/blob/c3969ed65f5c6135d828c47b9f9c162784d1c531/includes/class-geodir-ajax.php#L821-L825
• https://github.com/AyeCode/geodirectory/blob/c3969ed65f5c6135d828c47b9f9c162784d1c531/includes/class-geodir-post-data.php#L1321-L1326
• https://github.com/AyeCode/geodirectory/blob/c3969ed65f5c6135d828c47b9f9c162784d1c531/includes/class-geodir-post-data.php#L1502-L1550
• https://github.com/AyeCode/geodirectory/blob/c3969ed65f5c6135d828c47b9f9c162784d1c531/includes/class-geodir-post-data.php#L1658-L1737
• https://github.com/AyeCode/geodirectory/pull/3070/changes/29e519019f76a11c74a6b948da655148335f0d18
• https://plugins.trac.wordpress.org/changeset/3638028/geodirectory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e4fb4127-2b3f-4c8c-95ee-611f1bacf4c5?source=cve

Published

Aug 11, 2026

Last Modified

Aug 11, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19078A flaw was found in the oauth-server component. This open re…4.3
• CVE-2026-19079A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerab…4.4
• CVE-2026-1908The Integration with Hubspot Forms plugin for WordPress is v…6.4
• CVE-2026-19082Imager versions from 0.45_02 before 1.034 for Perl may expos…7.5
• CVE-2026-19089The Product Input Fields for WooCommerce WordPress plugin be…
• CVE-2026-1909The WaveSurfer-WP plugin for WordPress is vulnerable to Stor…6.4
• CVE-2026-1910The UpMenu – Online ordering for restaurants plugin for Word…6.4
• CVE-2026-19108A vulnerability was found in MZ Automation libiec61850 up to…5.3
• CVE-2026-1911The Twitter Feeds plugin for WordPress is vulnerable to Stor…6.4
• CVE-2026-19110A vulnerability was determined in DataGear up to 5.0.0. The …2.4
• CVE-2026-19111Insecure direct object reference in the mongodb_memory, elas…8.6
• CVE-2026-19113Consul Community Edition and Consul Enterprise 1.3.0 through…5.3