GeoDirectory CVE-2026-113490

Exploitation requires a target site running the GeoDirectory plugin at a version before 2.8.194 that contains non-public listings (draft, pending, private or trashed) and that exposes the plugin's single-item map-popup REST route, which is standard plugin functionality rather than a non-default toggle. The attacker must supply or enumerate the numeric listing ID of a non-public listing. No authentication, privileges or user interaction are required (PR:N/UI:N), so the practical limiting factors are: the leak is confined to the title, permalink and card fields (not the full listing body or private owner data), and the attacker must know or guess valid listing IDs. Sites with no non-public listings have no data to disclose.

This is a genuine but moderate-priority information-disclosure issue, not a high-urgency emergency. The CVSS 3.1 base score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - remote, low-complexity, unauthenticated, with only a LOW confidentiality impact and no integrity or availability impact, consistent with the description's limited leak (title, permalink and card fields of non-public listings). The exploitation-probability signals reinforce a measured view rather than an alarmist one: EPSS is 0.20% at the 9th percentile (low), there is no CISA KEV listing (not confirmed actively exploited), and the exploit reference is a WPScan advisory that is a public PoC reference, not verified as working exploit code. The vuln.today decision label is 'this_month', which aligns with a scheduled-remediation posture rather than act_now/emergency. The signals are mutually consistent: easy to trigger (AV:N/AC:L/PR:N) but low concrete impact (C:L only, metadata of unpublished listings), so ease of access is offset by limited payoff. No key signals conflict here; the main residual uncertainty is that the CPE vendor is recorded as 'unknown' rather than the actual maintainer, which does not change the risk picture.

An unauthenticated attacker enumerates numeric listing IDs and calls one of GeoDirectory's single-item map-popup REST routes for each ID, receiving the title, permalink and card fields of listings that are still in draft, pending, private or trashed status and should not be publicly visible. Because no authentication or user interaction is required (AV:N/PR:N/UI:N), this can be scripted at scale to harvest metadata about not-yet-published or withdrawn listings. A public PoC reference exists via WPScan; it is not verified as working exploit code.