WordPress GeoDirectory plugin <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment vulnerability

🗓️ 12 Nov 2025 03:59:00Reported by DityaRAType

patchstack

patchstack🔗 patchstack.com👁 4 Views

WordPress GeoDirectory Plugin versions up to 2.8.139 have broken access control; patch in 2.8.140.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-12833	12 Nov 202507:48	–	circl
CNNVD	WordPress plugin GeoDirectory – WP Business Directory Plugin and Classified Listings Directory 安全漏洞	12 Nov 202500:00	–	cnnvd
CVE	CVE-2025-12833	12 Nov 202504:29	–	cve
Cvelist	CVE-2025-12833 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment	12 Nov 202504:29	–	cvelist
EUVD	EUVD-2025-119997	12 Nov 202506:30	–	euvd
NVD	CVE-2025-12833	12 Nov 202505:15	–	nvd
Positive Technologies	PT-2025-46565	12 Nov 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-12833	13 Nov 202505:07	–	redhatcve
Vulnrichment	CVE-2025-12833 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment	12 Nov 202504:29	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (November 10, 2025 to November 16, 2025)	20 Nov 202516:10	–	wordfence

Vulners

Node

wordpress geodirectoryRange≤2.8.139

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/geodirectory/geodirectory-wp-business-directory-plugin-and-classified-listings-directory-28139-missing-authorization-to-authenticated-author-arbitrary-image-attachment

12 Nov 2025 03:59Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.14.3

EPSS0.00039

SSVC

WordPress GeoDirectory broken access control CVE-2025-12833 GeoDirectory versions up to 2.8.139 patch 2.8.140 low severity