The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress suffers from an authorization bypass vulnerability classified as CWE-639 (Authorization Bypass Through User-Controlled Key). This occurs in the 'post_attachment_upload' function where insufficient validation of a user-controlled key allows authenticated users with author-level privileges or above to attach arbitrary image files to arbitrary places within the plugin. This insecure direct object reference vulnerability affects all versions up to 2.8.139. The CVSS v3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

The vulnerability allows authenticated users with author-level access or higher to attach arbitrary image files to arbitrary locations within the plugin. This could lead to unauthorized modification of content or potential misuse of the attachment functionality. There is no direct impact on confidentiality or availability reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict author-level access to trusted users only and consider disabling or limiting the use of the affected 'post_attachment_upload' functionality if possible.