EUVD-2026-111727
GHSA-4562-6r2h-7rvw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor-level account
-
ExploitInsert field shortcode with target listing id
-
ExecutionRender page bypassing status/ownership check
-
ImpactDisclose other users' private listing content and custom fields
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account with the Contributor role or higher on a site running GeoDirectory before 2.8.195, and the attacker must reference a victim listing by its id attribute within a GeoDirectory field shortcode. Exposure is limited to the content and custom fields of listings in non-public states (draft, pending, private, trashed); it does not permit modification or deletion. The principal limiting factor is the Contributor-level authentication requirement, which rules out unauthenticated access, and the impact is confined to information disclosure of listing data rather than site compromise. |
| Impact | This is a low-severity information-disclosure issue (CWE-200) and the signals are mutually consistent rather than conflicting. The vendor CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N = 2.7) shows network-reachable but authenticated exploitation with only limited confidentiality impact and no integrity or availability impact. EPSS is 0.16% (5th percentile), there is no CISA KEV listing, and the vuln.today Decision label is 'monitor' - all pointing to low real-world urgency. The one internal tension worth flagging: the vendor scored PR:H, yet the description states exploitation only requires the Contributor role 'and above,' which is a low-privilege authenticated WordPress role - PR:L is the more defensible choice, which would raise the base score to roughly 4.3. Either way this remains a bounded data-exposure bug affecting only non-public listing content, not a code-execution or takeover primitive. Net assessment: a genuine but low-priority vulnerability - patch in normal cycles, not an emergency. |
| Exploit ScenarioDerived | An attacker who holds (or registers for) a Contributor-level account on a GeoDirectory-powered WordPress site creates or edits content containing a GeoDirectory field shortcode that references another user's listing by its id attribute. Because the plugin performs no status or ownership check, the rendered output leaks the content and custom fields of that listing even when it is in draft, pending, private, or trashed state. No public exploit is identified in the provided data, and the trigger beyond supplying the id attribute is not detailed in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
The GeoDirectory WordPress plugin before 2.8.195 renders listing data through its field shortcodes without verifying the status or ownership of the referenced listing, so an authenticated user holding the Contributor role or higher can read the content and custom fields of other users' draft, pending, private and trashed listings by supplying the corresponding id attribute. The exposure is read-only - no modification or deletion is possible - and is gated by the requirement for a Contributor-level account on the target site. A vendor patch is available in 2.8.195, EPSS is low at 0.16% (5th percentile) and there is no public exploit or KEV entry identified at time of analysis.
RemediationAI
Vendor-released patch: update GeoDirectory to version 2.8.195 or later - the vendor confirms a fix is available and the WPScan advisory (https://wpscan.com/vulnerability/29efa17c-fee7-4bd5-b52c-d0ce73bd786c/) documents the vulnerable range as everything below 2.8.195. Because exploitation requires a Contributor-or-above account, an interim exposure reduction is to audit and temporarily reduce the number of users holding Contributor or higher on sites where GeoDirectory cannot be updated immediately; the trade-off is that this blocks legitimate authoring and submission workflows for those accounts until the plugin is patched. Updating to 2.8.195 is the documented complete fix; no other vendor-documented workaround is listed in the available sources.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a CWE-200 information-exposure defect in a WordPress plugin's shortcode rendering path. GeoDirectory field shortcodes accept an id attribute that selects which listing to render, and the handler fails to compare the requested listing's post status (draft, pending, private, trashed versus publish) or its author against the requesting user before emitting content and custom field values. WordPress shortcodes execute wherever content is rendered, so any Contributor-or-above account able to author content containing such a shortcode can use it as a read primitive against listing IDs. The weakness class is a missing authorization/state check (exposure of sensitive information to an actor not explicitly authorized), not a memory-safety or injection issue; the description does not state whether the leak occurs on preview, on the front end, or in both, so the exact rendering context is unconfirmed. No CPE identifiers were supplied in the source data; the EUVD affected range is recorded as "GeoDirectory 0 <2.8.195".
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Contributor is a low-privilege authenticated role so PR:L (not PR:H); low confidentiality impact from leaked listing fields, with no integrity or availability impact.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes, allowing users with the Contributor role and above to disclose the content and custom fields of other users' draft, pending, private and trashed listings.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB