Low 2.7

The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check...

CVE-2026-113494 First seen on SecPulse Oct 28, 15:00

Affected packages

Ecosystem	Package	Affected	Fixed
CVE	GeoDirectory	< 2.8.195	2.8.195

Original description The description as published by the source.

The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes, allowing users with the Contributor role and above to disclose the content and custom fields of other users' draft, pending, private and trashed listings.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Low 2.7; CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Published: Oct 28, 2026
First seen on SecPulse: Oct 28, 15:00
GHSA: GHSA-4562-6r2h-7rvw
CWE: CWE-200

NVD GitHub Advisory

Tags(click for explanation)

Web Frameworks

WordPress

CWE

CWE-200

All

Geodirectory

Detection sources

NIST National Vulnerability Database03:17
GitHub Security Advisories (Global)03:33
CVE.org (CVE Program・cvelistV5)02:58