CVE-2026-113489

The GeoDirectory WordPress plugin (versions prior to 2.8.194 ) is vulnerable to an Insecure Direct Object Reference (IDOR) because it fails to verify that a referenced attachment belongs to the listing being saved. This allows users with Subscriber-level access and above to modify the title, capt...