◆ CVE Hub

CVE-2026-113490

SSVC: none

GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint

Published
2026-10-24
Last modified
2026-10-24
CNA
WPScan
NVD status
Received
CWE
CWE-200

Fetching some sources has been requested. Reload in about a minute to see them.

CVSS v3.1 (listed by NVD)
5.3
MEDIUM
Scored by CISA-ADP (not yet scored by NVD)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
—
Not scored
EPSS exploit probability
0.2%
Percentile 9.2%
as of 2026-10-24
CISA KEV
—
Not listed
SSVC (CISA ADP)
none
Automatable: yes / Impact: partial

Attack conditions and impact

Derived from the CISA-ADP (via NVD) CVSS 3.1 vector
NetworkNo authNo interaction Confidentiality LIntegrity NAvailability N

This vulnerability may be exploitable over the internet without authentication or user interaction.

MetricValueMeaning
Attack vector AVNNetwork
Attack complexity ACLLow (easy)
Privileges required PRNNone
User interaction UINNone
Scope SUUnchanged
Confidentiality CLLow
Integrity INNone
Availability ANNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

NVD

The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.

CVSS assessments

ProviderVersionScoreVector
NVD / 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)3.15.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
ADP / CISA-ADP3.15.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products and packages

CNA (CVE.org)

VendorProductVersions
UnknownGeoDirectory
affected: 0 … < 2.8.194
default: unaffected

Linux distribution status

Red Hat ↗ Fetching

Debian ↗

No record

Ubuntu ↗ Fetching

References (1)