---
id: "CVE-2026-113494"
kind: "vulnerability"
aliases: ["CVE-2026-113494"]
title: "GeoDirectory WordPress plugin leaks draft and private listings via shortcodes"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["geodirectory", "multi-user-sites", "package", "wordpress"]
not_affected_if: ["no-contributor-accounts", "version-2.8.195-or-later"]
published_at: "2026-10-28T06:16:35+00:00"
first_seen_at: "2026-10-28T06:31:27+00:00"
updated_at: "2026-10-28T06:32:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113494", "first_seen_at": "2026-10-28T06:31:27+00:00"}]
---

# GeoDirectory WordPress plugin leaks draft and private listings via shortcodes

The GeoDirectory WordPress plugin before 2.8.195 renders listings referenced by an id attribute in its field shortcodes without checking status or ownership. A logged-in user with the Contributor role or higher can read the content and custom fields of other users' draft, pending, private and trashed listings.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GeoDirectory plugin version in the WordPress admin Plugins screen, or run `wp plugin get geodirectory --field=version` with WP-CLI
- Confirm whether the site accepts Contributor-level accounts that are not trusted

## Fix

- Update the GeoDirectory plugin to `2.8.195` or later

## Timeline

- 2026-10-28T06:31:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113494

## From the sources

The GeoDirectory  WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes, allowing users with the Contributor role and above to disclose the content and custom fields of other users' draft, pending, private and trashed listings.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_