CVE-2026-113490

GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint

The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.

Affected

GeoDirectory

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.28% chance of exploitation in the next 30 days, 21st percentile

Published

2026-10-24

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/2901f8f3-0b35-4565-b248-6c0dfc5de894/find archive

CVE references

• https://wpscan.com/vulnerability/2901f8f3-0b35-4565-b248-6c0dfc5de894REFERENCE

References

• CVE Record
• NVD entry