{"id":"CVE-2026-113490","kind":"vulnerability","aliases":["CVE-2026-113490"],"related":[],"title":"GeoDirectory WordPress plugin leaks draft and private listings to anyone","description":"The GeoDirectory  WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.","summary":"The GeoDirectory WordPress plugin before 2.8.194 renders map popups for single listings through a REST route without checking status or ownership. An unauthenticated visitor who knows a listing ID can read the title, permalink and card fields of draft, pending, private and trashed listings.","severity":"medium","cvss":null,"epss":0.00199,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["geodirectory","package","self-hosted","wordpress"],"not_affected_if":["no-non-public-listings","plugin-updated"],"how_to_check":"- Check the installed GeoDirectory version in the WordPress plugins screen or `wp plugin get geodirectory --field=version`\n- Confirm the plugin is active on the site","fix":"- Update the GeoDirectory plugin to `2.8.194` or later","status":"open","published_at":"2026-10-24T06:16:36+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","triaged_at":"2026-10-25T04:51:56+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:51:56Z","model":"claude-haiku-5-5","output":{"fix":"- Update the GeoDirectory plugin to `2.8.194` or later","reach":"internet","title":"GeoDirectory WordPress plugin leaks draft and private listings to anyone","impact":"low","summary":"The GeoDirectory WordPress plugin before 2.8.194 renders map popups for single listings through a REST route without checking status or ownership. An unauthenticated visitor who knows a listing ID can read the title, permalink and card fields of draft, pending, private and trashed listings.","category":"package","nicknames":[],"who_cares":["wordpress","geodirectory","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated readers see titles and card data of hidden listings","analyst_note":"","how_to_check":"- Check the installed GeoDirectory version in the WordPress plugins screen or `wp plugin get geodirectory --field=version`\n- Confirm the plugin is active on the site","needs_analyst":false,"not_affected_if":["plugin-updated","no-non-public-listings"],"who_is_affected":"Sites running the GeoDirectory plugin before `2.8.194` that have non-public listings (drafts, pending, private or trashed) whose titles or details should stay hidden. The exposure is read-only and limited to the listing card fields. Sites without the plugin, or sites already on `2.8.194` or later, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00059,"input_tokens":3322,"output_tokens":515,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113490':13A,16A '-2026':12A,15A '2.8.194':28B,72C 'allow':98C 'anyon':10A 'card':58B,107C 'check':40B,80C 'cve':11A,14A 'draft':5A,61B,113C 'field':59B,108C 'geodirectori':1A,17B,24B,68C 'host':21B 'id':51B,123C 'item':95C 'know':48B 'leak':4A 'list':8A,34B,50B,66B,84C,118C,122C 'map':30B,87C 'map-popup':86C 'non':111C 'non-publ':110C 'one':90C 'ownership':43B,79C 'packag':18B 'pend':62B,114C 'perform':75C 'permalink':56B,105C 'plugin':3A,26B,70C 'popup':31B,88C 'privat':7A,63B,115C 'public':112C 'read':53B,102C 'render':29B,82C 'rest':37B,96C 'rout':38B,97C 'self':20B 'self-host':19B 'singl':33B,94C 'single-item':93C 'status':41B,77C 'suppli':120C 'titl':55B,104C 'trash':65B,117C 'unauthent':45B,99C 'user':100C 'visitor':46B 'without':39B 'wordpress':2A,22B,25B,69C","nicknames":[],"mitigations":[],"who_affected":"Sites running the GeoDirectory plugin before `2.8.194` that have non-public listings (drafts, pending, private or trashed) whose titles or details should stay hidden. The exposure is read-only and limited to the listing card fields. Sites without the plugin, or sites already on `2.8.194` or later, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T06:16:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113490","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113490","severity":null,"published_at":"2026-10-24T06:16:36+00:00","modified_at":"2026-10-24T06:16:36+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","fetched_at":"2026-10-24T06:47:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-113490","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113490","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}