The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'design_type' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The required nonce is trivially obtainable by any anonymous visitor, as the geodir_basic_nonce value is localized to every public frontend page via the geodir_params script object, meaning no authentication, user interaction, or specific site content is required to exploit this vulnerability.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-104899 represents a critical Local File Inclusion (LFI) vulnerability in the popular GeoDirectory WordPress plugin, affecting all versions through 2.8.187. The vulnerability exists in the 'design_type' parameter, which fails to properly validate or sanitize user input before including files from the server. This is particularly severe because it requires no authentication—any unauthenticated attacker can exploit it by crafting malicious requests to include arbitrary PHP files from the WordPress installation or server filesystem. Organizations using this plugin for business directories or classified listings are immediately at risk, as successful exploitation enables arbitrary PHP code execution, leading to complete server compromise, data exfiltration, and lateral movement within the network.
While this CVE doesn't map to specific MITRE ATT&CK techniques in the current framework, Casky's Claude AI-powered analysis would detect exploitation patterns associated with file inclusion attacks through behavioral anomalies: suspicious parameter manipulation in HTTP requests, unusual file access patterns targeting sensitive PHP files (wp-config.php, wp-load.php), and execution of code that typically doesn't run through normal WordPress workflows. Practitioners reviewing Casky findings would observe flagged requests containing traversal sequences (../ or encoded variants) in the 'design_type' parameter, along with subsequent indicators of code execution such as new process spawning, unexpected outbound connections, or privilege escalation attempts. The lack of authentication context combined with file inclusion activity is the critical detection signal that distinguishes this attack from normal plugin functionality.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-104899. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation