Medium 5.3

The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password...

CVE-2026-113492 First seen on SecPulse Oct 24, 15:00

Affected packages

Ecosystem	Package	Affected	Fixed
CVE	GeoDirectory	< 2.8.194	2.8.194

Original description The description as published by the source.

The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.3; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published: Oct 24, 2026
First seen on SecPulse: Oct 24, 15:00
GHSA: GHSA-jj25-wjr9-4f42
CWE: CWE-200

NVD GitHub Advisory

Tags(click for explanation)

Web Frameworks

WordPress

CWE

CWE-200

All

Geodirectory

Detection sources

NIST National Vulnerability DatabaseOct 26, 22:50
GitHub Security Advisories (Global)Oct 25, 00:32
CVE.org (CVE Program・cvelistV5)Oct 24, 23:36