EUVD-2026-54890
GHSA-9fxx-p9p4-4fjv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible and unauthenticated per CVSS vector; C:L rather than C:H because only two specific fields per listing are disclosed, not total loss of confidentiality.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.
AnalysisAI
GeoDirectory WordPress plugin versions before 2.8.169 leak the title and exact geographic coordinates of non-public (pending or draft) listings to unauthenticated HTTP requests due to a missing authorization check on the map marker data endpoint. Any internet-accessible WordPress site running an affected version inadvertently exposes private listing location data to anonymous callers. No public exploit code has been identified at time of analysis, and the vendor has released a fix in version 2.8.169.
Technical ContextAI
GeoDirectory is a WordPress plugin providing geolocation directory functionality, including map-based rendering of business or place listings via marker data served from a dedicated endpoint. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the endpoint responsible for returning map marker data for a single requested listing performs no authorization check before responding, allowing any HTTP client to supply a listing ID and receive the associated title and GPS coordinates regardless of the listing's publication status. Affected versions span all GeoDirectory releases from 0 up to but not including 2.8.169, as confirmed by the WPScan advisory and NVD entry. No CPE string was supplied in the input data, but the affected component is the GeoDirectory plugin for the WordPress platform.
RemediationAI
Update GeoDirectory to version 2.8.169 or later, confirmed as the patched release by the WPScan vendor advisory at https://wpscan.com/vulnerability/162fa8ab-4d80-46f8-9a15-63c8dfd0be33/. If immediate patching is not feasible, a targeted compensating control is to block or rate-limit requests to the map marker data endpoint at the web server or WAF layer - note this will degrade map preview functionality for legitimate users until the update is applied. Alternatively, administrators can temporarily set all pending or draft listings to a private state that does not feed the affected endpoint, reducing the pool of disclosable data without disabling the plugin. No workaround fully eliminates the authorization gap without patching; the update is the only confirmed remediation.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today