CVE-2026-114270
Received Received - Intake

Unauthenticated Content Disclosure in GeoDirectory WordPress Plugin

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: WPScan

Description
The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-114270
EUVD
EUVD-2026-112628

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown GeoDirectory 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The GeoDirectory WordPress plugin before version 2.8.197 has a flaw where it does not enforce post password protection when rendering listings. This allows unauthenticated users to view the content and custom fields of published listings that are supposed to be protected by a password.

Detection Guidance

To detect this vulnerability, check if your GeoDirectory plugin version is prior to 2.8.197. You can verify the installed version via WordPress admin panel or by inspecting the plugin files. No specific commands are provided in the context, but manual verification of the plugin version is recommended.

Impact Analysis

Unauthenticated users could access sensitive information in password-protected listings, including custom fields. This could lead to unauthorized disclosure of private data, such as user details or proprietary content, without requiring any authentication.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by exposing sensitive data without proper authorization. It may result in data breaches, violating privacy requirements and potentially leading to legal penalties or reputational damage.

Mitigation Strategies

Immediately update the GeoDirectory plugin to version 2.8.197 or later. This can be done through the WordPress admin panel under Plugins. If updating is not possible, consider temporarily disabling the plugin until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114270. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart