Technical impact
The plugin fails to perform status, ownership, or password checks when retrieving a listing via its unauthenticated AJAX handler. Attackers can send any numeric listing ID to the public endpoint and obtain the full contents of drafts, pending, or private listings. This results in confidential data leakage (CWE‑200).
Affected Systems
All installations of the GeoDirectory WordPress plugin running a version earlier than 2.8.194 are at risk. The vendor name is GeoDirectory, and the known affected version range is < 2.8.194. Site owners with any installation below this release have the unauthenticated ‘Recently Viewed Listings’ AJAX endpoint exposed, enabling disclosure without authentication.
Risk and Exploitability
The exploit is straightforward HTTP requests to a known URL, requiring no credentials, which raises the practical attack difficulty. The EPSS score is < 1 %, indicating a very low but not zero probability of exploitation, and the CVSS score of 5.3 places the vulnerability in the medium range. It is not yet listed in the CISA KEV catalog. However, the potential for private data exposure makes the risk significant for sites that store sensitive draft content.
