Live › vulnerability › CVE-2026-114270
The GeoDirectory WordPress plugin, before version 2.8.197, ignores post password protection when it renders a listing. An unauthenticated visitor can therefore read the content and custom fields of published listings that should be locked behind a password.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Sites running the GeoDirectory plugin before 2.8.197 that use post password protection on listings. Sites without GeoDirectory, or without password-protected listings, are not exposed by this flaw as described.
No product ranges from the sources yet.
2.8.197 are affected.2.8.197 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.
This page as .md · .json · in your agent: get_signal("CVE-2026-114270")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.