Live › vulnerability › CVE-2026-113492
Go to dashboardThe GeoDirectory WordPress plugin, before version 2.8.194, has an unauthenticated AJAX handler that skips status, ownership and password checks when loading listings. An anonymous visitor who supplies the ID of a draft, pending or private listing can read its content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 06:47 UTC. All times on this page are UTC.
Sites running the GeoDirectory WordPress plugin before 2.8.194 that hold non-public listings (draft, pending or private) are exposed, since the flaw is reachable without logging in. Sites that do not use GeoDirectory, or that run a patched version, can skip it.
No product ranges from the sources yet.
wp plugin get geodirectory --field=version if WP-CLI is available.geodirectory directory under wp-content/plugins/ and confirm its version header.2.8.194 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.
This page as .md · .json · in your agent: get_signal("CVE-2026-113492")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.