The GeoDirectory WordPress plugin before version 2.8.194 renders a listing’s map‑popup through a single‑item REST route without verifying the requesting user’s status or ownership of the listing. By providing a valid listing ID, any unauthenticated visitor can retrieve the title, permalink, and card details of listings that are in draft, pending, private, or trashed states, thereby exposing sensitive content that should remain confidential.

The vulnerability affects installations of the GeoDirectory WordPress plugin that are running any version earlier than 2.8.194. All WordPress sites utilizing this plugin are potentially impacted if they have not upgraded to the patched release.

The exploitation does not require authentication or elevated privileges, and the input is a simple HTTP request to a REST endpoint. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalogue, indicating no known public exploitation at this time. However, because the flaw allows disclosure of private listings, it can have moderate to high impact on confidentiality, especially for sensitive or proprietary content.