# GeoDirectory <= 2.8.193 - Unauthenticated Sensitive Information Exposure via REST Marker Popup and Recently Viewed Listings

- **ID:** WPSEC-2026-1388
- **Plugin:** GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (`geodirectory`), https://wordpress.org/plugins/geodirectory/
- **Affected versions:** all versions before 2.8.194
- **Fixed in:** 2.8.194 (Update to 2.8.194 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/geodirectory
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1388/

## Description

The GeoDirectory plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.193 due to missing visibility checks on the REST API map marker popup endpoint and the recently viewed listings AJAX handler, which render listings by ID regardless of their status. This makes it possible for unauthenticated attackers to view the content of draft, pending, private and revision listings. Listing field shortcodes such as [gd_post_meta id=X] were similarly affected for authenticated users with Contributor-level access and above.

## References

- https://wpsec.com/vuln/WPSEC-2026-1388/
- https://plugins.svn.wordpress.org/geodirectory/tags/2.8.194/
- https://wordpress.org/plugins/geodirectory/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1388/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.