Vulnerabilities / GeoDirectory – WP Business Directory Plugin and Classified Listings Directory / WPSEC-2026-2110
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.198 - Unauthenticated Sensitive Information Exposure via Password-Protected Template Pages
Medium 5.3
CWE-200Fixed in 2.8.199
- ID
- WPSEC-2026-2110
- Plugin
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (geodirectory)
- Affected
- all versions before 2.8.199
- Remediation
- Update to 2.8.199 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory on WPSec AttackSurface
- Fix released
- Published
Description
The GeoDirectory plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.198 via the template page and Elementor skin parameters of the listings and Best Of widgets. This is due to the plugin rendering published template pages and skins without checking whether they are password protected. This makes it possible for unauthenticated attackers to view the content of password-protected pages by supplying their IDs as widget template parameters.
References
- https://wpsec.com/vuln/WPSEC-2026-2110/
- https://plugins.svn.wordpress.org/geodirectory/tags/2.8.199/
- https://wordpress.org/plugins/geodirectory/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS