Live › vulnerability › CVE-2026-113490
Go to dashboardThe GeoDirectory WordPress plugin before 2.8.194 renders map popups for single listings through a REST route without checking status or ownership. An unauthenticated visitor who knows a listing ID can read the title, permalink and card fields of draft, pending, private and trashed listings.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 06:47 UTC. All times on this page are UTC.
Sites running the GeoDirectory plugin before 2.8.194 that have non-public listings (drafts, pending, private or trashed) whose titles or details should stay hidden. The exposure is read-only and limited to the listing card fields. Sites without the plugin, or sites already on or later, can skip it.
2.8.194No product ranges from the sources yet.
wp plugin get geodirectory --field=version2.8.194 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.
This page as .md · .json · in your agent: get_signal("CVE-2026-113490")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.