Description

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). By placing post_type=attachment exclusively in the query string to bypass the consistency check, an attacker can convert an auto-draft GeoDirectory listing into a WordPress attachment with attacker-controlled file paths injected into attachment metadata, which the delete_revision handler then dereferences and unlinks without any post-type or path validation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-11T20:17:38.797Z",
  "pubdate": "2026-08-11T20:17:38.797Z",
  "executiveSummary": "The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to an arbitrary file deletion flaw across all versions up to, and including, 2.8.169. This vulnerability permits authenticated attackers with subscriber-level access and above to delete arbitrary files on the underlying hosting server. The security deficiency stems from insufficient file path validation within the delete_revision function. Successful exploitation carries severe risk implications, as the targeted deletion of critical system files, such as wp-config.php, can readily facilitate remote code execution or lead to total site compromise and denial of service. The attack requires authenticated access at the subscriber tier or higher, alongside the manipulation of query string parameters to bypass intended consistency checks.",
  "technicalDetails": "The root cause of the vulnerability resides in the delete_revision function within the GeoDirectory plugin. The component fails to perform adequate file path validation and lacks rigorous post-type verification prior to dereferencing and unlinking files. Exploitation requires authenticated access with subscriber-level privileges or higher. The attack flow commences when an attacker manipulates the request by placing post_type=attachment exclusively in the query string. This specific injection successfully bypasses the internal consistency check of the application, effectively converting an auto-draft GeoDirectory listing into a standard WordPress attachment. Subsequently, the attacker injects malicious, attacker-controlled file paths directly into the attachment metadata. When the vulnerable delete_revision handler processes the request, it directly dereferences and unlinks these injected file paths without executing any subsequent post-type checks or path sanitization. Consequently, the underlying operating system executes a file deletion operation against the specified target path. The payload behavior allows the targeted removal of arbitrary files accessible to the web server user. The post-exploitation impact includes the potential cascading failure of the WordPress installation, installation corruption, or escalation to remote code execution through the subsequent re-installation or re-configuration of the application following the deletion of configuration files like wp-config.php."
}