CVE-2026-114270: GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure

Q: Which listings are exposed?

Published GeoDirectory listings protected with a WordPress post password may expose their content and custom fields. Listings that are not password-protected are not the specific condition described by this issue.

Q: Does an attacker need credentials or the listing password?

No. The issue allows unauthenticated users to disclose the protected content and custom fields without the post password.

Q: How can I determine whether my site is affected?

Check whether GeoDirectory is earlier than version 2.8.197 and whether you have published listings using WordPress post password protection. Those listings should be treated as potentially disclosed to unauthenticated visitors.

Published Oct 29, 2026

Updated

The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.

Affected Software

1 affected component

GeoDirectory GeoDirectory<2.8.197

Event History

Oct 29, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which listings are exposed?

Published GeoDirectory listings protected with a WordPress post password may expose their content and custom fields. Listings that are not password-protected are not the specific condition described by this issue.

Does an attacker need credentials or the listing password?

No. The issue allows unauthenticated users to disclose the protected content and custom fields without the post password.

How can I determine whether my site is affected?

Check whether GeoDirectory is earlier than version 2.8.197 and whether you have published listings using WordPress post password protection. Those listings should be treated as potentially disclosed to unauthenticated visitors.