CVE-2026-113492: GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action
The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated user can exploit the affected AJAX handler. No account or elevated WordPress role is required.
What does an attacker need to access non-public listings?
The attacker needs to supply the IDs of the targeted listings to the recently viewed listings AJAX action. The affected handler does not validate listing status, ownership, or password protection.
Which listing states may be exposed?
Draft, pending, and private listings may be disclosed. Password-protected listings may also be exposed because the handler does not perform password checks.
How can I determine whether my site is affected?
Sites running GeoDirectory versions before 2.8.194 are affected. Review whether non-public listings exist, as their content may be retrievable through the unauthenticated recently viewed listings AJAX handler.