What is CVE-2026-113491?

CVE-2026-113491 is a medium-severity vulnerability in Geodirectory, classified under Path Traversal. CVSS score: 6.4/10. Published 2026-10-24.

How severe is CVE-2026-113491?

Medium severity. CVSS v3 base score is 6.4 out of 10.

Path Traversal in Geodirectory

CVE-2026-113491

The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.

Vulnerability class: Path Traversal (Directory Traversal)

Published 2026-10-24 · last modified 2026-10-24.

CVSS v3 metric

CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Geodirectory

Weakness classification (CWE)

CWE-22 — Path Traversal

References

wpscan.com/vulnerability/ba2114a5-01e3-40e7-a7f6-673674b6501d/ (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-113491?: CVE-2026-113491 is a medium-severity vulnerability in Geodirectory, classified under Path Traversal. CVSS score: 6.4/10. Published 2026-10-24.
How severe is CVE-2026-113491?: Medium severity. CVSS v3 base score is 6.4 out of 10.