The GeoDirectory WordPress plugin prior to version 2.8.194 exposes an AJAX handler that retrieves listing data without verifying the status, ownership, or password protection of the requested listing. Attackers can supply any numeric listing ID and obtain the full content of listings marked as draft, pending, or private, resulting in unauthorized disclosure of confidential or unreleased data. This vulnerability is a classic example of improper access control (CWE‑284).

All installations of the GeoDirectory plugin running a version earlier than 2.8.194 are affected. The vendor, GeoDirectory, does not list specific sub‑versions; therefore any site that has not upgraded past the stated release is vulnerable. The exploit works against the default public endpoint and requires no authentication, so any internet‑connected user can request the endpoint with a valid ID. The plugin is widely deployed on WordPress sites, increasing the attack surface.

The flaw allows unauthenticated read access to non‑public listings via a public AJAX endpoint in the plugin. Because the attack is simple HTTP requests to a known URL and the EPSS score is not provided, the exploitation probability is uncertain. The vulnerability is not currently documented in the CISA Known Exploited Vulnerabilities catalog, and no CVSS score is supplied. Nonetheless, the confidentiality impact is significant for sites that store sensitive draft data, making the risk medium to high for impacted deployments.