{
 "id": "WPSEC-2026-2110",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2110/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2110/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2110/index.md",
 "title": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.198 - Unauthenticated Sensitive Information Exposure via Password-Protected Template Pages",
 "description": "The GeoDirectory plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.198 via the template page and Elementor skin parameters of the listings and Best Of widgets. This is due to the plugin rendering published template pages and skins without checking whether they are password protected. This makes it possible for unauthenticated attackers to view the content of password-protected pages by supplying their IDs as widget template parameters.",
 "plugin": {
  "slug": "geodirectory",
  "name": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory",
  "full_name": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory",
  "wordpress_org": "https://wordpress.org/plugins/geodirectory/",
  "advisories_url": "https://wpsec.com/vuln/plugin/geodirectory/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/geodirectory"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.8.199",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.8.199"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.8.199",
 "remediation": "Update to 2.8.199 or later.",
 "fix_released": "2026-10-29T14:43:27+00:00",
 "published": "2026-10-30T14:47:12+00:00",
 "updated": "2026-10-30T09:24:33.827956+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2110/",
  "https://plugins.svn.wordpress.org/geodirectory/tags/2.8.199/",
  "https://wordpress.org/plugins/geodirectory/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/geodirectory",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}