{"id":"CVE-2026-113492","kind":"vulnerability","aliases":["CVE-2026-113492"],"related":[],"title":"GeoDirectory WordPress plugin leaks draft and private listings to anyone","description":"The GeoDirectory  WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.","summary":"The GeoDirectory WordPress plugin, before version 2.8.194, has an unauthenticated AJAX handler that skips status, ownership and password checks when loading listings. An anonymous visitor who supplies the ID of a draft, pending or private listing can read its content.","severity":"medium","cvss":null,"epss":0.00199,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["geodirectory","package","self-hosted","wordpress"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed GeoDirectory plugin version in the WordPress admin under Plugins, or with `wp plugin get geodirectory --field=version` if WP-CLI is available.\n- Look for the plugin's `geodirectory` directory under `wp-content/plugins/` and confirm its version header.","fix":"- Update the GeoDirectory plugin to `2.8.194` or later.\n- Unknown whether a workaround exists before updating; the sources do not say.","status":"open","published_at":"2026-10-24T06:16:36+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","triaged_at":"2026-10-25T04:51:53+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:51:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update the GeoDirectory plugin to `2.8.194` or later.\n- Unknown whether a workaround exists before updating; the sources do not say.","reach":"internet","title":"GeoDirectory WordPress plugin leaks draft and private listings to anyone","impact":"low","summary":"The GeoDirectory WordPress plugin, before version 2.8.194, has an unauthenticated AJAX handler that skips status, ownership and password checks when loading listings. An anonymous visitor who supplies the ID of a draft, pending or private listing can read its content.","category":"package","nicknames":[],"who_cares":["wordpress","geodirectory","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Anonymous users read draft, pending and private listing content.","analyst_note":"","how_to_check":"- Check the installed GeoDirectory plugin version in the WordPress admin under Plugins, or with `wp plugin get geodirectory --field=version` if WP-CLI is available.\n- Look for the plugin's `geodirectory` directory under `wp-content/plugins/` and confirm its version header.","needs_analyst":false,"not_affected_if":["patched-version","plugin-not-installed"],"who_is_affected":"Sites running the GeoDirectory WordPress plugin before 2.8.194 that hold non-public listings (draft, pending or private) are exposed, since the flaw is reachable without logging in. Sites that do not use GeoDirectory, or that run a patched version, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000612,"input_tokens":3312,"output_tokens":561,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113492':13A,16A '-2026':12A,15A '2.8.194':29B,68C 'ajax':33B,85C 'allow':87C 'anonym':46B 'anyon':10A 'check':41B,76C 'content':62B,93C 'cve':11A,14A 'disclos':91C 'draft':5A,54B,98C 'geodirectori':1A,17B,24B,64C 'handler':34B,86C 'host':21B 'id':51B,106C 'leak':4A 'list':8A,44B,58B,79C,102C 'load':43B,78C 'non':96C 'non-publ':95C 'one':81C 'ownership':38B,73C 'packag':18B 'password':40B,75C 'pend':55B,99C 'perform':71C 'plugin':3A,26B,66C 'privat':7A,57B,101C 'public':97C 'read':60B 'self':20B 'self-host':19B 'skip':36B 'status':37B,72C 'suppli':49B,104C 'unauthent':32B,84C,88C 'user':89C 'version':28B 'visitor':47B 'wordpress':2A,22B,25B,65C","nicknames":[],"mitigations":[],"who_affected":"Sites running the GeoDirectory WordPress plugin before 2.8.194 that hold non-public listings (draft, pending or private) are exposed, since the flaw is reachable without logging in. Sites that do not use GeoDirectory, or that run a patched version, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T06:16:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113492","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113492","severity":null,"published_at":"2026-10-24T06:16:36+00:00","modified_at":"2026-10-24T06:16:36+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","fetched_at":"2026-10-24T06:47:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-113492","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113492","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}