# GeoDirectory <= 2.8.195 - Unauthenticated Sensitive Information Exposure of Password-Protected Listing Content via REST API, Field Output and SEO Meta Variables

- **ID:** WPSEC-2026-1524
- **Plugin:** GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (`geodirectory`), https://wordpress.org/plugins/geodirectory/
- **Affected versions:** all versions before 2.8.196
- **Fixed in:** 2.8.196 (Update to 2.8.196 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/geodirectory
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1524/

## Description

The GeoDirectory plugin for WordPress is vulnerable to Sensitive Information Exposure via the content and excerpt of the listings REST API response, textarea and post content field output, the output location widget and shortcode, and SEO title and meta variables in all versions up to, and including, 2.8.195. This is due to the plugin not checking whether a listing's post password has been supplied before returning the raw post content and excerpt in REST responses, rendering textarea fields and post content, showing listing detail fields in the output location widget, and replacing %%excerpt%%, category and custom field placeholders in page titles and meta tags. This makes it possible for unauthenticated attackers to read the content, excerpt and some field values of password-protected listings without knowing the password.

## References

- https://wpsec.com/vuln/WPSEC-2026-1524/
- https://plugins.svn.wordpress.org/geodirectory/tags/2.8.196/
- https://wordpress.org/plugins/geodirectory/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1524/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.