EUVD-2026-112628
GHSA-px45-rpjf-xj4w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify password-protected GeoDirectory listing
-
ExploitSend unauthenticated HTTP request to listing
-
ExecutionPlugin renders without enforcing password
-
ImpactDisclose listing content and custom fields
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a target GeoDirectory listing is both published and protected by a WordPress post password - the flaw only manifests for listings in that specific password-protected state, so sites with no password-protected listings are not exposed. No authentication, user interaction, or special configuration beyond installing an affected GeoDirectory version (before 2.8.197) is needed, consistent with PR:N/UI:N. The practical limit on impact is that only content and custom fields of already-published listings are disclosed (confidentiality only); no write, code-execution, or availability impact occurs, and the data exposed is content the owner chose to publish but gate behind a password. |
| Impact | This is a genuine but modest-severity information-disclosure issue, not an urgent emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3 Medium) is internally consistent with the description: a remote, unauthenticated, low-complexity request that leaks only confidentiality (C:L) with no integrity or availability impact. SSVC reinforces a measured posture - Exploitation: none (no observed exploitation), Automatable: yes (the request can be scripted at scale against many sites), Technical Impact: partial - which aligns with the vuln.today 'this_month' priority rather than act_now. It is not in CISA KEV, and no EPSS score was supplied, so widespread or active exploitation cannot be asserted. A PoC reference exists (WPScan) but is not verified as working exploit code, so this should not be conflated with confirmed exploitation. Net: a real, scriptable confidentiality bug worth patching this month, but the limited impact (content of already-published, merely password-gated listings) keeps real-world risk moderate rather than critical. |
| Exploit ScenarioDerived | An unauthenticated attacker requests a published GeoDirectory listing that the owner protected with a post password; because the plugin does not enforce the password gate at render time, the full listing content and custom fields are returned without the password. A public PoC reference from WPScan exists but is not verified as working exploit code; since the flaw is automatable, an attacker could script enumeration of protected listings across many sites. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 29, 2026
GeoDirectory, a WordPress directory/listing plugin, renders published listings without honouring the WordPress post-password gate in versions before 2.8.197, so unauthenticated visitors can read the body content and custom fields of listings whose owners marked them as password-protected. Only listings that are both published and carry a post password are exposed; there is no write, code-execution or availability impact, which is why the issue scores 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) with confidentiality as the sole limited impact. Exploitation is assessed as none in SSVC and there is no CISA KEV entry, though a public PoC reference exists on the WPScan advisory and is not verified as working exploit code; a vendor fix is available in 2.8.197 and the issue is prioritised for remediation this month rather than as an emergency.
RemediationAI
Upgrade the GeoDirectory plugin to version 2.8.197 or later; a vendor patch is available and the WPScan advisory at https://wpscan.com/vulnerability/1d217334-b749-4abd-9d95-4941cd69ae55/ documents the fix. Because disclosure only occurs for listings that are simultaneously published and protected by a post password, a site that cannot update immediately can reduce exposure by removing the post password from those listings and unpublishing them, or by moving the sensitive content out of the listing and custom fields until the plugin is patched; the trade-off is that password-protected listings either become publicly readable as ordinary published content or disappear from the directory for the duration. No other compensating control is described in the available sources.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WordPress lets an author set a post password, after which core filters the content through the password form and withholds the body until the correct password is submitted. GeoDirectory bypasses that path: its own listing templates and query/render logic output the listing description and the plugin's custom field data (stored in GeoDirectory's own tables rather than as standard post content) directly, so the core post_password check is never applied to the rendered listing. The result is a CWE-200 exposure of information the site owner intended to restrict, reachable over the network by any anonymous visitor who requests the affected listing URL. The CPE string provided is cpe:2.3:a:unknown:geodirectory:*:*:*:*:*:*:*:* with the vendor recorded as unknown and the version left as a wildcard, so the authoritative version scope comes from the EUVD data (GeoDirectory 0 through 2.8.196, i.e. before 2.8.197). The sources do not describe the exact code path or hook where the password check is skipped; the trigger is only characterised as occurring when a password-protected listing is rendered.
Know when Geodirectory gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Remote unauthenticated request with no user interaction (AV:N/AC:L/PR:N/UI:N); only confidentiality of listing content is partially exposed (C:L), with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Geodirectory
View allGeoDirectory, a WordPress directory plugin, writes administrator-supplied text into a generated PHP file inside its own
Stored cross-site scripting in the GeoDirectory WordPress plugin before 2.8.194 allows an authenticated user holding the
Information disclosure in the GeoDirectory WordPress plugin (before 2.8.168) exposes the email addresses of all register
Authenticated path traversal in the GeoDirectory WordPress plugin before 2.8.194 allows any user holding a Subscriber-le
The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before o
The GeoDirectory Business Directory WordPress plugin before 2.1.1.3 was vulnerable to Authenticated Stored Cross-Site Sc
Unauthenticated SQL injection in the GeoDirectory WordPress plugin (versions up to and including 2.8.152) allows remote
SQL injection in the GeoDirectory WordPress plugin (versions 2.8.174 and earlier) lets unauthenticated remote attackers
GeoDirectory WordPress plugin versions before 2.8.194 fail to enforce status, ownership and password checks in an unauth
Unauthenticated visitors to WordPress sites running GeoDirectory before 2.8.194 can retrieve the title, permalink and ca
Cross-Site Request Forgery in the GeoDirectory WordPress plugin (versions ≤ 2.8.176) enables remote unauthenticated atta
Missing Authorization vulnerability in AyeCode - WP Business Directory Plugins GeoDirectory allows Exploiting Incorrectl
Exploit-DB