Live › vulnerability › CVE-2026-113494
Go to dashboardThe GeoDirectory WordPress plugin before 2.8.195 renders listings referenced by an id attribute in its field shortcodes without checking status or ownership. A logged-in user with the Contributor role or higher can read the content and custom fields of other users' draft, pending, private and trashed listings.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running GeoDirectory before that have user accounts with the Contributor role or higher, since those users can reach the shortcode rendering path. Sites with only administrators and editors, or with no multi-user accounts, have less exposure to other users' unpublished listings. The sources do not say whether the flaw is reachable by unauthenticated visitors.
2.8.195No product ranges from the sources yet.
wp plugin get geodirectory --field=version with WP-CLI2.8.195 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes, allowing users with the Contributor role and above to disclose the content and custom fields of other users' draft, pending, private and trashed listings.
This page as .md · .json · in your agent: get_signal("CVE-2026-113494")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.