CVE-2025-12833: 
WordPress vulnerability analysis and mitigation

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.139. The vulnerability was discovered by DityaRA and publicly disclosed on November 11, 2025, with the last update on November 12, 2025. The issue affects the plugin's post attachment upload functionality (NVD Database).

The vulnerability exists in the 'postattachmentupload' function due to missing validation on a user-controlled key. This security flaw has been assigned a CVSS v3.1 score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The issue is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) (NVD Database, Wordfence).

The vulnerability allows authenticated attackers with author-level access and above to attach arbitrary image files to arbitrary places within the system. This could potentially lead to unauthorized manipulation of content and image attachments (NVD Database).

The vulnerability has been patched in version 2.8.140 of the GeoDirectory plugin. Users are advised to update to this version or later to address the security issue. The fix includes extra validation for post attachment uploads (GitHub Commit).