What is GHSA-54m2-gc24-q2f7?

GHSA-54m2-gc24-q2f7 is a security advisory published by GitHub Security Advisories with Medium severity. The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL...

Which CVE IDs does GHSA-54m2-gc24-q2f7 cover?

GHSA-54m2-gc24-q2f7 covers the following CVE IDs: CVE-2026-113491. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-54m2-gc24-q2f7?

GHSA-54m2-gc24-q2f7 has a CVSS v3 base score of 6.4, published by GitHub Security Advisories.

GHSA-54m2-gc24-q2f7MediumCVSS 6.4

The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL...

Vendor

GitHub Security Advisories

Published

October 24, 2026

Last Modified

October 24, 2026

🔗 CVE IDs covered (1)

CVE-2026-113491 →

📋 Description

The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-113491
https://wpscan.com/vulnerability/ba2114a5-01e3-40e7-a7f6-673674b6501d
https://github.com/advisories/GHSA-54m2-gc24-q2f7