{"id":"CVE-2026-113494","kind":"vulnerability","aliases":["CVE-2026-113494"],"related":[],"title":"GeoDirectory WordPress plugin leaks draft and private listings via shortcodes","description":"The GeoDirectory  WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes, allowing users with the Contributor role and above to disclose the content and custom fields of other users' draft, pending, private and trashed listings.","summary":"The GeoDirectory WordPress plugin before 2.8.195 renders listings referenced by an id attribute in its field shortcodes without checking status or ownership. A logged-in user with the Contributor role or higher can read the content and custom fields of other users' draft, pending, private and trashed listings.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["geodirectory","multi-user-sites","package","wordpress"],"not_affected_if":["no-contributor-accounts","version-2.8.195-or-later"],"how_to_check":"- Check the installed GeoDirectory plugin version in the WordPress admin Plugins screen, or run `wp plugin get geodirectory --field=version` with WP-CLI\n- Confirm whether the site accepts Contributor-level accounts that are not trusted","fix":"- Update the GeoDirectory plugin to `2.8.195` or later","status":"open","published_at":"2026-10-28T06:16:35+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","triaged_at":"2026-10-28T06:32:26+00:00","updated_at":"2026-10-28T06:32:26+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T06:32:26Z","model":"claude-haiku-5-5","output":{"fix":"- Update the GeoDirectory plugin to `2.8.195` or later","reach":"internet","title":"GeoDirectory WordPress plugin leaks draft and private listings via shortcodes","impact":"low","summary":"The GeoDirectory WordPress plugin before 2.8.195 renders listings referenced by an id attribute in its field shortcodes without checking status or ownership. A logged-in user with the Contributor role or higher can read the content and custom fields of other users' draft, pending, private and trashed listings.","category":"package","nicknames":[],"who_cares":["wordpress","geodirectory","multi-user-sites"],"confidence":0.6,"needs_auth":"yes","worst_case":"Contributors read other users' unpublished listing content and custom fields","analyst_note":"","how_to_check":"- Check the installed GeoDirectory plugin version in the WordPress admin Plugins screen, or run `wp plugin get geodirectory --field=version` with WP-CLI\n- Confirm whether the site accepts Contributor-level accounts that are not trusted","needs_analyst":false,"not_affected_if":["version-2.8.195-or-later","no-contributor-accounts"],"who_is_affected":"Sites running GeoDirectory before `2.8.195` that have user accounts with the Contributor role or higher, since those users can reach the shortcode rendering path. Sites with only administrators and editors, or with no multi-user accounts, have less exposure to other users' unpublished listings. The sources do not say whether the flaw is reachable by unauthenticated visitors.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000618,"input_tokens":3314,"output_tokens":573,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113494':13A,16A '-2026':12A,15A '2.8.195':29B,78C 'allow':100C 'attribut':36B,95C 'check':42B,86C 'content':60B,111C 'contributor':53B,104C 'custom':62B,113C 'cve':11A,14A 'disclos':109C 'draft':5A,67B,118C 'field':39B,63B,98C,114C 'geodirectori':1A,17B,25B,74C 'higher':56B 'id':35B,94C 'leak':4A 'list':8A,31B,72B,90C,123C 'log':48B 'logged-in':47B 'multi':19B 'multi-user-sit':18B 'ownership':45B,85C 'packag':22B 'pend':68B,119C 'perform':81C 'plugin':3A,27B,76C 'privat':7A,69B,120C 'read':58B 'referenc':32B,91C 'render':30B,88C 'role':54B,105C 'shortcod':10A,40B,99C 'site':21B 'status':43B,83C 'trash':71B,122C 'user':20B,50B,66B,101C,117C 'via':9A 'without':41B 'wordpress':2A,23B,26B,75C","nicknames":[],"mitigations":[],"who_affected":"Sites running GeoDirectory before `2.8.195` that have user accounts with the Contributor role or higher, since those users can reach the shortcode rendering path. Sites with only administrators and editors, or with no multi-user accounts, have less exposure to other users' unpublished listings. The sources do not say whether the flaw is reachable by unauthenticated visitors.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113494","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113494","severity":null,"published_at":"2026-10-28T06:16:35+00:00","modified_at":"2026-10-28T06:16:35+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","fetched_at":"2026-10-28T06:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}