CVE-2026-113490None▾ SunlitThe GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.
GeoDirectory < 2.8.194Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113492NoneGeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action
CVE-2026-113493NoneGeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute
CVE-2026-113491NoneGeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal
CVE-2026-113489NoneGeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR
CVE-2026-113673NoneGeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export
CVE-2026-113674NoneGeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification