CVE-2026-113489 GeoDirectory CVE debrief

Who should care

Defenders responsible for WordPress installations with the GeoDirectory plugin, security teams monitoring for potential image modification vulnerabilities, and operators managing affected plugin deployments should assess exposure, verify inventory of plugin versions, restrict user access and permissions, and monitor for suspicious image modifications.

Why it matters

CVE-2026-113489 is a vulnerability in the GeoDirectory WordPress plugin that allows unauthorized modification of images and their metadata. Defenders responsible for WordPress installations with the GeoDirectory plugin should assess exposure and verify inventory of plugin versions, restrict user access and permissions, and monitor for suspicious image modifications.

• Potential unauthorized modification of images and their metadata
• Possible exploitation by users with Subscriber-level access and above
• Need for verification of GeoDirectory plugin versions and user access permissions
• Potential impact on image integrity and authenticity

Technical summary

The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image. This vulnerability potentially impacts image integrity and authenticity, and defenders should assess exposure and verify inventory of GeoDirectory plugin versions, restrict user access and permissions, and monitor for suspicious image modifications.

Defensive priority

Assess exposure and verify inventory of GeoDirectory plugin versions, restrict user access and permissions, monitor for suspicious image modifications

Recommended defensive actions

• Assess exposure by verifying GeoDirectory plugin versions and user access permissions
• Restrict user access and permissions to prevent unauthorized image modifications
• Monitor for suspicious image modifications and changes to image metadata
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is limited. Defenders should verify GeoDirectory plugin versions, user access permissions, and monitor for suspicious image modifications. The vulnerability allows unauthorized modification of images and their metadata, potentially impacting image integrity and authenticity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.