WordPress Plugin Vulnerabilities

GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure

Description

The plugin does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.

Proof of Concept

Affects Plugins

Plugin icon
geodirectory
Fixed in 2.8.197

References

CVE
CVE-2026-114270

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Erwan LR (WPScan)
Submitter
Erwan LR (WPScan)
Verified
Yes
WPVDB ID
1d217334-b749-4abd-9d95-4941cd69ae55

Timeline

Publicly Published
2026-10-27 (about 2 days ago)
Added
2026-10-27 (about 1 day ago)
Last Updated
2026-10-27 (about 1 day ago)

Other

Published
Title
Published
2024-10-09
Title
Keep Backup Daily <= 2.1.2 - Unauthenticated Information Disclosure
Published
2024-12-17
Title
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction < 2.13.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
Published
2023-12-28
Title
404 Solution < 2.33.1 - Sensitive Information Exposure via Log File
Published
2022-01-14
Title
WP Import Export < 3.9.16 - Unauthenticated Sensitive Data Disclosure
Published
2025-01-24
Title
WooCommerce Quick View < 1.1.3 - Unauthenticated Information Disclosure