Description
The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.
Published: 2026-10-29
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Immediate Patch
AI Analysis

Impact

Unauthorized users can view the full content and custom fields of listings protected by a post password because the GeoDirectory plugin fails to enforce the password requirement during rendering. This results in a confidentiality breach, exposing potentially private or sensitive data stored in the listings.

Affected Systems

The vulnerability affects the GeoDirectory WordPress plugin on any WordPress site running a version earlier than 2.8.197. Users of the plugin who have enabled post passwords on listings are at risk.

Risk and Exploitability

The flaw can be exploited simply by requesting the URL of a password‑protected listing. No authentication or special privileges are required. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but the lack of password enforcement implies a high potential for abuse if an attacker discovers sensitive listings.

Generated by OpenCVE AI on October 29, 2026 at 12:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the GeoDirectory plugin to version 2.8.197 or later where the password enforcement bug is fixed.
  • If an immediate upgrade is not possible, temporarily block unauthenticated access to listed URLs or remove post passwords from sensitive listings until the plugin can be updated.
  • After the update, audit all listings to ensure no password‑protected content remains exposed.

Generated by OpenCVE AI on October 29, 2026 at 12:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-285

Thu, 29 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 29 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Thu, 29 Oct 2026 08:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-285

Thu, 29 Oct 2026 06:15:00 +0000

Type Values Removed Values Added
Description The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.
Title GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-29T10:56:06.088Z

Reserved: 2026-10-21T07:06:02.933Z

Link: CVE-2026-114270

cve-icon Vulnrichment

Updated: 2026-10-29T10:48:03.495Z

cve-icon NVD

Status : Received

Published: 2026-10-29T06:17:18.980

Modified: 2026-10-29T11:17:28.323

Link: CVE-2026-114270

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T13:00:22Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor