CVE-2026-19091 is a path traversal vulnerability (CWE-22) in the GeoDirectory – WP Business Directory Plugin and Classified Listings Directory for WordPress. The vulnerability arises from insufficient validation of file paths in the delete_revision function, allowing authenticated users with subscriber-level privileges or higher to delete arbitrary files on the server. The attack involves placing post_type=attachment in the query string to bypass consistency checks, converting an auto-draft GeoDirectory listing into a WordPress attachment with attacker-controlled file paths in the attachment metadata. The delete_revision handler then dereferences and unlinks these paths without validating the post type or file path, enabling arbitrary file deletion and potential remote code execution.

An attacker with subscriber-level access or higher can delete arbitrary files on the server, which may lead to remote code execution if critical files such as wp-config.php are deleted. This compromises the integrity and availability of the affected system and can result in full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user access and monitor for suspicious activity related to file deletions. Avoid granting unnecessary privileges to users and consider disabling or limiting the use of the vulnerable plugin if possible.