CVE-2026-113492
Received Received - Intake

Unauthenticated Listing Content Disclosure in GeoDirectory WordPress Plugin

Publication date: 2026-10-24

Last updated on: 2026-10-24

Assigner: WPScan

Description
The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-24
Last Modified
2026-10-24
Generated
2026-10-24
AI Q&A
2026-10-24
EPSS Evaluated
N/A
NVD
CVE-2026-113492
EUVD
EUVD-2026-109214

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown GeoDirectory 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The GeoDirectory WordPress plugin before version 2.8.194 has a vulnerability in an unauthenticated AJAX handler called 'Recently Viewed Listings'. This handler does not verify the status, ownership, or password of listings, allowing unauthenticated users to access non-public listings such as draft, pending, or private ones by providing their IDs.

Detection Guidance

To detect this vulnerability, check if your GeoDirectory plugin version is prior to 2.8.194. You can verify the installed version via WordPress admin panel or by inspecting plugin files. Additionally, monitor network traffic for unauthenticated AJAX requests to the 'Recently Viewed Listings' endpoint.

Impact Analysis

This vulnerability allows unauthorized users to view sensitive or unpublished content on your WordPress site, potentially exposing confidential information or draft content that was meant to remain private.

Mitigation Strategies

Immediately update the GeoDirectory plugin to version 2.8.194 or later. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Ensure all non-public listings are reviewed for unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113492. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart