GeoDirectory <= 2.8.195 - Unauthenticated Sensitive Information Exposure of Password-Protected Listing Content via REST API, Field Output and SEO Meta Variables
- ID
- WPSEC-2026-1524
- Plugin
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (geodirectory)
- Affected
- all versions before 2.8.196
- Remediation
- Update to 2.8.196 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-23
- Attack surface
- GeoDirectory on WPSec AttackSurface
- Fix released
- Published
Description
The GeoDirectory plugin for WordPress is vulnerable to Sensitive Information Exposure via the content and excerpt of the listings REST API response, textarea and post content field output, the output location widget and shortcode, and SEO title and meta variables in all versions up to, and including, 2.8.195. This is due to the plugin not checking whether a listing's post password has been supplied before returning the raw post content and excerpt in REST responses, rendering textarea fields and post content, showing listing detail fields in the output location widget, and replacing %%excerpt%%, category and custom field placeholders in page titles and meta tags. This makes it possible for unauthenticated attackers to read the content, excerpt and some field values of password-protected listings without knowing the password.
References
- https://wpsec.com/vuln/WPSEC-2026-1524/
- https://plugins.svn.wordpress.org/geodirectory/tags/2.8.196/
- https://wordpress.org/plugins/geodirectory/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS