CVE-2026-113490: GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint
The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated user who can reach the affected GeoDirectory REST route can exploit it. No login or ownership of the targeted listing is required.
What information can be exposed?
An attacker can retrieve the title, permalink, and card fields for non-public listings, including draft, pending, private, and trashed listings.
What does an attacker need to target a specific non-public listing?
The attacker needs to supply the listing ID to the affected single-item marker-popup REST route.
Are publicly accessible sites affected by default?
The issue is reachable without authentication through the affected REST route. Exposure is relevant where GeoDirectory has non-public listings whose IDs can be supplied to that endpoint.