{
 "id": "WPSEC-2026-1388",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1388/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1388/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1388/index.md",
 "title": "GeoDirectory <= 2.8.193 - Unauthenticated Sensitive Information Exposure via REST Marker Popup and Recently Viewed Listings",
 "description": "The GeoDirectory plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.193 due to missing visibility checks on the REST API map marker popup endpoint and the recently viewed listings AJAX handler, which render listings by ID regardless of their status. This makes it possible for unauthenticated attackers to view the content of draft, pending, private and revision listings. Listing field shortcodes such as [gd_post_meta id=X] were similarly affected for authenticated users with Contributor-level access and above.",
 "plugin": {
  "slug": "geodirectory",
  "name": "GeoDirectory",
  "full_name": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory",
  "wordpress_org": "https://wordpress.org/plugins/geodirectory/",
  "advisories_url": "https://wpsec.com/vuln/plugin/geodirectory/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/geodirectory"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.8.194",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.8.194"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.8.194",
 "remediation": "Update to 2.8.194 or later.",
 "fix_released": "2026-10-20T17:17:09+00:00",
 "published": "2026-10-21T17:49:01+00:00",
 "updated": "2026-10-21T10:34:26.900159+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1388/",
  "https://plugins.svn.wordpress.org/geodirectory/tags/2.8.194/",
  "https://wordpress.org/plugins/geodirectory/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/geodirectory",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}