{
 "id": "WPSEC-2026-1524",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1524/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1524/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1524/index.md",
 "title": "GeoDirectory <= 2.8.195 - Unauthenticated Sensitive Information Exposure of Password-Protected Listing Content via REST API, Field Output and SEO Meta Variables",
 "description": "The GeoDirectory plugin for WordPress is vulnerable to Sensitive Information Exposure via the content and excerpt of the listings REST API response, textarea and post content field output, the output location widget and shortcode, and SEO title and meta variables in all versions up to, and including, 2.8.195. This is due to the plugin not checking whether a listing's post password has been supplied before returning the raw post content and excerpt in REST responses, rendering textarea fields and post content, showing listing detail fields in the output location widget, and replacing %%excerpt%%, category and custom field placeholders in page titles and meta tags. This makes it possible for unauthenticated attackers to read the content, excerpt and some field values of password-protected listings without knowing the password.",
 "plugin": {
  "slug": "geodirectory",
  "name": "GeoDirectory",
  "full_name": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory",
  "wordpress_org": "https://wordpress.org/plugins/geodirectory/",
  "advisories_url": "https://wpsec.com/vuln/plugin/geodirectory/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/geodirectory"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.8.196",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.8.196"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.8.196",
 "remediation": "Update to 2.8.196 or later.",
 "fix_released": "2026-10-22T13:12:04+00:00",
 "published": "2026-10-23T13:44:58+00:00",
 "updated": "2026-10-23T09:48:38.935961+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1524/",
  "https://plugins.svn.wordpress.org/geodirectory/tags/2.8.196/",
  "https://wordpress.org/plugins/geodirectory/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/geodirectory",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-23"
 }
}