GeoDirectory: Unauthenticated Local File Inclusion via design_type parameter
Summary
GeoDirectory, a WordPress plugin for business directories, does not properly restrict the 'design_type' parameter, which is used in a template path. Unauthenticated attackers can include and execute arbitrary .php files on the server, which can lead to access control bypass, data exposure or code execution. The required nonce is publicly exposed on frontend pages, so no login or user interaction is needed. Code execution is most likely where PHP files can be uploaded or are writable.
Affected
- GeoDirectory plugin for WordPress, all versions up to and including 2.8.187
Fixed in
- Version 2.8.188 (fix in commit 2357d640; changelog entry marked FIXED/SECURITY)
Workaround
- Unknown. No vendor workaround published.
- Interim hardening: restrict PHP uploads and writable directories.
Exploitation
- No known exploitation in the wild according to the sources; not listed in KEV.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found in the research, which does not rule one out.
Our recommendation
- Update GeoDirectory to 2.8.188 or later on all WordPress sites immediately.
- Check for unexpected .php files and review recent file changes.
- Block or restrict PHP uploads to the media library and other writable directories.
- Monitor web server logs for requests with the design_type parameter.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub commit 2357d640 (fix, version 2.8.188) github.com
- WordPress.org Trac changeset 3725126 plugins.trac.wordpress.org
- Wordfence threat intelligence entry www.wordfence.com
- Vulnerable code in version 2.8.187 (widget tags) plugins.trac.wordpress.org
- WPScan plugin entry GeoDirectory wpscan.com
- Freshysites security bulletin freshysites.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:21.
Original description (NVD)
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'design_type' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The required nonce is trivially obtainable by any anonymous visitor, as the geodir_basic_nonce value is localized to every public frontend page via the geodir_params script object, meaning no authentication, user interaction, or specific site content is required to exploit this vulnerability.
NVD references (7)
- https://github.com/AyeCode/geodirectory/commit/2357d640dad7973988742a6706b3a857b6b05d52
- https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.187/includes/class-geodir-ajax.php#L709
- https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.187/includes/template-functions.php#L143
- https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.187/includes/template-functions.php#L199
- https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.187/includes/widgets/class-geodir-widget-tag…
- https://plugins.trac.wordpress.org/changeset/3725126/geodirectory/trunk/includes/widgets/class-geodir-widget-…
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ac817587-1403-46e2-84bf-be5fcadc5425?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.