Vendor

Ayecode

2 briefs RSS

Unauthenticated Local File Inclusion in GeoDirectory WordPress Plugin

The GeoDirectory plugin for WordPress is vulnerable to unauthenticated local file inclusion (LFI) via the design_type parameter, allowing remote attackers to execute arbitrary PHP code.

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory lfi wordpress web-application-vulnerability

1r 1t 1c Oct 10, 2026

high advisory

Arbitrary File Deletion in GeoDirectory Plugin

1 TTP 1 CVE

The GeoDirectory WordPress plugin contains an arbitrary file deletion vulnerability (CVE-2026-19091) allowing authenticated attackers to delete critical files and potentially achieve remote code execution.

GeoDirectory web-application-vulnerability wordpress arbitrary-file-deletion

1t 1c Aug 11, 2026