# CVE-2026-104899: GeoDirectory local file inclusion via design_type parameter

Source: https://junglewise.ai/threats/cve-2026-104899-the-geodirectory-wp-business-directory-plugin-and-classified  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-10. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-104899 · Severity: high · CVSS 8.1 · Published 2026-10-10

GeoDirectory is a WordPress plugin that creates business directories and classified listings. An unauthenticated attacker can exploit a flaw in the design_type parameter to include and execute arbitrary PHP files on the server, leading to complete site compromise. The vulnerability requires no special access because the required security token is publicly visible in every page's source code.

Technologies: [AyeCode GeoDirectory](https://junglewise.ai/threats/technologies/ayecode-geodirectory). Vendors: [AyeCode](https://junglewise.ai/threats/vendors/ayecode).

## Quick answers

**Is CVE-2026-104899 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104899 being exploited in the wild.

**How severe is CVE-2026-104899?** High severity, with a CVSS score of 8.1, published 10 October 2026.

**Which products and versions are affected?** AyeCode GeoDirectory up to and including 2.8.187.

**Is there a fix for CVE-2026-104899?** Yes: fixed in 2.8.188. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104899 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-104899?** Check whether you run AyeCode GeoDirectory at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.8.188

## Technical details

A local file inclusion vulnerability in the design_type parameter allows unauthenticated attackers to include and execute arbitrary PHP files. The vulnerability is trivially exploitable because the required nonce value (geodir_basic_nonce) is localized to the frontend via the geodir_params JavaScript object, accessible to any visitor without authentication or user interaction. An attacker can upload a malicious PHP file through other means and then include it, or exploit existing PHP files, to achieve arbitrary code execution.

## Affected products

- AyeCode GeoDirectory up to and including 2.8.187

## Timeline

- 2026-10-10: disclosed
- 2026-10-02: patched

## References

- [https://github.com/AyeCode/geodirectory/commit/2357d640dad7973988742a6706b3a857b6b05d52](https://github.com/AyeCode/geodirectory/commit/2357d640dad7973988742a6706b3a857b6b05d52)
- [https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.187/includes/class-geodir-ajax.php](https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.187/includes/class-geodir-ajax.php)

## Related threats

- [GeoDirectory stored cross-site scripting in post content](https://junglewise.ai/threats/cve-2026-120082-the-geodirectory-wp-business-directory-plugin-and-classified)
- [GeoDirectory stored cross-site scripting in post_images parameter](https://junglewise.ai/threats/cve-2026-116752-the-geodirectory-wp-business-directory-plugin-and-classified)
- [GeoDirectory WP Business Directory stored cross-site scripting in listing description](https://junglewise.ai/threats/cve-2026-119113-the-geodirectory-wp-business-directory-plugin-and-classified)
- [GeoDirectory arbitrary shortcode execution](https://junglewise.ai/threats/cve-2026-118635-the-the-geodirectory-wp-business-directory-plugin-and-classified)
- [GeoDirectory WP Business Directory stored XSS in twitterusername](https://junglewise.ai/threats/cve-2026-111069-the-geodirectory-wp-business-directory-plugin-and-classified)