CVE-2026-19091: GeoDirectory Path Traversal Vulnerability

CVE-2026-19091 Overview

CVE-2026-19091 is an arbitrary file deletion vulnerability in the GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress. The flaw affects all versions up to and including 2.8.169. Authenticated attackers with subscriber-level access or higher can delete arbitrary files on the server. Deleting wp-config.php can escalate the issue to remote code execution by forcing WordPress into an unconfigured state on the next request. The vulnerability lives in the delete_revision function, which fails to validate file paths retrieved from attachment metadata under attacker control.

Critical Impact
Any authenticated subscriber can trigger deletion of wp-config.php and pivot to remote code execution on the WordPress host.

Affected Products

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (WordPress plugin)
All versions up to and including 2.8.169
Deployments running the affected plugin with any user role at subscriber level or above

Discovery Timeline

2026-08-11 - CVE-2026-19091 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19091

Vulnerability Analysis

The vulnerability is a path traversal and arbitrary file deletion issue classified under [CWE-22]. GeoDirectory exposes an AJAX handler that invokes delete_revision to clean up revisions tied to a listing. The handler dereferences file paths stored in attachment metadata and calls unlink on them. No post-type check or path canonicalization occurs before deletion. Because the metadata is writable during listing creation, an attacker can plant arbitrary absolute or relative paths and have the plugin remove them.

The upstream fix is tracked in the GeoDirectory pull request and shipped through the WordPress plugin repository changeset 3638028. See the Wordfence vulnerability analysis for further detail.

Root Cause

The root cause is insufficient consistency checking between request parameters and the underlying post type. By placing post_type=attachment exclusively in the query string, an attacker bypasses the plugin's consistency check that normally rejects non-listing operations. The auto-draft GeoDirectory listing is then treated as a WordPress attachment. Attacker-controlled file paths injected into the attachment metadata flow into delete_revision without any post-type validation or path sanitization.

Attack Vector

Exploitation requires an authenticated session at the subscriber role or above, which is the default self-registration role on many WordPress sites. The attacker submits crafted requests to the plugin's AJAX endpoint with post_type=attachment in the query string and a malicious file path embedded in the attachment metadata. The delete_revision handler then reads the injected path and unlinks the target file. Deleting wp-config.php triggers the WordPress installation flow on the next request, which an attacker can use to bind the site to a database they control and achieve remote code execution.

Refer to the vulnerable code paths in class-geodir-ajax.php lines 821-825 and class-geodir-post-data.php lines 1502-1550 for the affected logic.

Detection Methods for CVE-2026-19091

Indicators of Compromise

Unexpected absence of wp-config.php or other core WordPress files followed by a redirect to the WordPress installation wizard.
POST requests to admin-ajax.php containing the post_type=attachment query string paired with GeoDirectory actions.
Attachment metadata rows in wp_postmeta referencing paths outside the WordPress uploads directory.
New subscriber account registrations followed shortly by AJAX activity targeting GeoDirectory endpoints.

Detection Strategies

Alert on any request to admin-ajax.php where post_type=attachment appears only in the query string while the POST body references GeoDirectory actions.
Monitor for unlink or file deletion events on PHP files inside the WordPress root originating from the web server user.
Correlate low-privilege authenticated sessions with subsequent file system changes in web-accessible directories.

Monitoring Recommendations

Enable WordPress audit logging for attachment creation, metadata updates, and revision deletion by non-administrator roles.
Track file integrity for wp-config.php, .htaccess, and files under wp-content/plugins/geodirectory/.
Review web server access logs for repeated calls to GeoDirectory AJAX actions from newly registered accounts.

How to Mitigate CVE-2026-19091

Immediate Actions Required

Update the GeoDirectory plugin to a version newer than 2.8.169 that includes the fix from changeset 3638028.
Audit user registrations and remove any subscriber accounts that were created without a business justification.
Verify the integrity of wp-config.php and other WordPress core files; restore from a known-good backup if tampering is detected.
Rotate database credentials and any secrets stored in wp-config.php if arbitrary file deletion is suspected.

Patch Information

The vendor patch is available through the WordPress plugin repository. Details are published in the GeoDirectory pull request 3070 and the WordPress Trac changeset. The fix adds post-type validation and path sanitization to the delete_revision handler so attachment metadata cannot be used to unlink arbitrary files.

Workarounds

Disable open user registration or set the default new user role below subscriber where possible.
Restrict access to admin-ajax.php GeoDirectory actions using a web application firewall rule that blocks post_type=attachment in the query string for GeoDirectory endpoints.
Deactivate the GeoDirectory plugin until the patched version is deployed if the site does not require it in production.

bash

# Configuration example: WP-CLI plugin update workflow
wp plugin update geodirectory
wp plugin get geodirectory --field=version
# Confirm the installed version is greater than 2.8.169