Vulnerability · Published Oct 28, 2026 · Assigned by WPScan
CVE-2026-113494GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode
Low 2.7
In plain English
A low-severity information exposure in GeoDirectory from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 3.1)2.7Low
Exploit odds (30 days)0.2%top 84.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes, allowing users with the Contributor role and above to disclose the content and custom fields of other users' draft, pending, private and trashed listings.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | GeoDirectory | 0 – before 2.8.195 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
References
- https://wpscan.com/vulnerability/29efa17c-fee7-4bd5-b52c-d0ce73bd786c/ exploit, vdb-entry, technical-description