---
id: "CVE-2026-113492"
kind: "vulnerability"
aliases: ["CVE-2026-113492"]
title: "GeoDirectory WordPress plugin leaks draft and private listings to anyone"
severity: "medium"
cvss: null
epss: 0.00199
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["geodirectory", "package", "self-hosted", "wordpress"]
not_affected_if: ["patched-version", "plugin-not-installed"]
published_at: "2026-10-24T06:16:36+00:00"
first_seen_at: "2026-10-24T06:47:03+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113492", "first_seen_at": "2026-10-24T06:47:03+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-113492", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# GeoDirectory WordPress plugin leaks draft and private listings to anyone

The GeoDirectory WordPress plugin, before version 2.8.194, has an unauthenticated AJAX handler that skips status, ownership and password checks when loading listings. An anonymous visitor who supplies the ID of a draft, pending or private listing can read its content.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GeoDirectory plugin version in the WordPress admin under Plugins, or with `wp plugin get geodirectory --field=version` if WP-CLI is available.
- Look for the plugin's `geodirectory` directory under `wp-content/plugins/` and confirm its version header.

## Fix

- Update the GeoDirectory plugin to `2.8.194` or later.
- Unknown whether a workaround exists before updating; the sources do not say.

## Timeline

- 2026-10-24T06:47:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113492
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-113492

## From the sources

The GeoDirectory  WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_