CVE-2026-114270 PUBLISHED

GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure

Assigner: WPScan
Reserved: 21.10.2026 Published: 29.10.2026 Updated: 29.10.2026

The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.

Product Status

Vendor Unknown
Product GeoDirectory
Versions Default: unaffected
  • affected from 0 to 2.8.197 (excl.)

Credits

  • Erwan LR (WPScan) finder
  • WPScan coordinator

References

Problem Types

  • CWE-200 Information Exposure CWE