CVE-2026-113489 — MEDIUM (4.3)

Vulnerability Description

The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

NONE

Related Weaknesses (CWE)

CWE-639

References

https://wpscan.com/vulnerability/2f539d43-6f95-494f-b399-21697145591e/

FAQ

What is CVE-2026-113489?

CVE-2026-113489 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the t...

How severe is CVE-2026-113489?

CVE-2026-113489 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-113489?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.