CVE-2026-113492

UNKNOWN 0.0

GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.

Vendor	unknown
Product	geodirectory
Published	Oct 24, 2026

Stay Ahead of the Next One

Get instant alerts for unknown geodirectory

Be the first to know when new unknown vulnerabilities affecting unknown geodirectory are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / GeoDirectory

0 < 2.8.194

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/5a1c17a0-c513-4f64-91c7-09c0f1878c71/

Credits

Jacek Sowiński WPScan