CVE-2026-113490 Details
Description
The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.
A vulnerability in the GeoDirectory WordPress plugin, affecting versions prior to 2.8.194, allows unauthenticated users to access sensitive information from non-public listings. The plugin's single-item REST routes for rendering map popups do not include status or ownership checks. As a result, users can retrieve the title, permalink, and card fields of draft, pending, private, and trashed listings by providing the corresponding listing ID.
Users are advised to update the GeoDirectory WordPress plugin to version 2.8.194 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 24, 2026CISA-ADP
Assessed Oct 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/2901f8f3-0b35-4565-b248-6c0dfc5de894/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| GeoDirectory | < 2.8.194 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 24, 2026 | CVE Modified | CISA-ADP |
| Oct 24, 2026 | New CVE Received | [email protected] |