GeoDirectory EUVD-2026-109214

Exploitation requires only that the GeoDirectory plugin (any version before 2.8.194) be installed and reachable, with the affected unauthenticated AJAX handler exposed as it is by default - no authentication, no user interaction, and no special plugin configuration are described as prerequisites. The practical requirement is that the target site actually contains non-public listings (draft, pending, private, or password-protected) whose numeric IDs the attacker can supply or enumerate; a site with only published listings has little to disclose. The limiting factor on impact, not on exploitability, is that only listing content is exposed (confidentiality-only, C:L) - no write access, code execution, or account data is implied by the description.

This is a genuine but moderate-priority information-disclosure flaw, not a high-urgency emergency. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) is internally consistent with the description: network-reachable, low-complexity, no authentication, no user interaction, with only a low confidentiality impact and no integrity or availability impact - matching a CWE-200 disclosure of non-public listing content. The supporting signals point to low real-world pressure: EPSS is 0.20% (9th percentile), there is no CISA KEV listing, and the exploit artifact is a WPScan advisory reference that is not verified as working exploit code. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a patch-this-cycle posture rather than drop-everything. The main tension is that PR:N/AC:L makes exploitation trivially easy and scriptable, yet the impact is bounded to reading draft/pending/private listing content (C:L only) - so ease of exploitation is high but consequence is limited. No conflicting data was found; the vendor-assigned severity, the description, and the CVSS vector all agree.

An unauthenticated attacker enumerates numeric listing IDs and sends them to the vulnerable GeoDirectory AJAX handler, which returns the content of listings regardless of their draft, pending, or private status. Over sequential IDs this exposes unpublished or deliberately non-public directory entries (and any password-protected ones) without logging in. A public PoC reference exists via WPScan; it is not verified as working exploit code.