# GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.198 - Unauthenticated Sensitive Information Exposure via Password-Protected Template Pages

- **ID:** WPSEC-2026-2110
- **Plugin:** GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (`geodirectory`), https://wordpress.org/plugins/geodirectory/
- **Affected versions:** all versions before 2.8.199
- **Fixed in:** 2.8.199 (Update to 2.8.199 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/geodirectory
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2110/

## Description

The GeoDirectory plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.198 via the template page and Elementor skin parameters of the listings and Best Of widgets. This is due to the plugin rendering published template pages and skins without checking whether they are password protected. This makes it possible for unauthenticated attackers to view the content of password-protected pages by supplying their IDs as widget template parameters.

## References

- https://wpsec.com/vuln/WPSEC-2026-2110/
- https://plugins.svn.wordpress.org/geodirectory/tags/2.8.199/
- https://wordpress.org/plugins/geodirectory/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2110/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.