{"id":"CVE-2026-16988","title":"The GeoDirectory  WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinat…","summary":"The GeoDirectory  WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinat…","severity":"none","published":"2026-08-09","updated":"2026-08-09","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-16988","references":[{"url":"https://wpscan.com/vulnerability/162fa8ab-4d80-46f8-9a15-63c8dfd0be33/","label":"contact@wpscan.com"}],"tags":["nvd"],"epss":0.00256,"epssPercentile":0.17548,"ingestedAt":"2026-08-09T15:33:38.043Z","slug":"CVE-2026-16988","body":"## Overview\n\nThe GeoDirectory  WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}