Vulnerabilities / GeoDirectory / WPSEC-2026-1388
GeoDirectory <= 2.8.193 - Unauthenticated Sensitive Information Exposure via REST Marker Popup and Recently Viewed Listings
Medium 5.3
CWE-639Fixed in 2.8.194
- ID
- WPSEC-2026-1388
- Plugin
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (geodirectory)
- Affected
- all versions before 2.8.194
- Remediation
- Update to 2.8.194 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-21
- Attack surface
- GeoDirectory on WPSec AttackSurface
- Fix released
- Published
Description
The GeoDirectory plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.193 due to missing visibility checks on the REST API map marker popup endpoint and the recently viewed listings AJAX handler, which render listings by ID regardless of their status. This makes it possible for unauthenticated attackers to view the content of draft, pending, private and revision listings. Listing field shortcodes such as [gd_post_meta id=X] were similarly affected for authenticated users with Contributor-level access and above.
References
- https://wpsec.com/vuln/WPSEC-2026-1388/
- https://plugins.svn.wordpress.org/geodirectory/tags/2.8.194/
- https://wordpress.org/plugins/geodirectory/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS