WordPress Plugin Vulnerabilities
GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action
Description
The plugin does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.
Proof of Concept
Affects Plugins
Fixed in 2.8.194 References
CVE
Classification
Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Jacek Sowiński
Submitter
Jacek Sowiński
Submitter twitter
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-10-22 (about 2 days ago)
Added
2026-10-22 (about 1 day ago)
Last Updated
2026-10-22 (about 1 day ago)
