Unrated severityNVD Advisory· Published Oct 28, 2026

CVE-2026-113494

Description

The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes, allowing users with the Contributor role and above to disclose the content and custom fields of other users' draft, pending, private and trashed listings.

Affected products

WordPress/Geodirectoryllm-fuzzy
Range: <2.8.195
Package: https://wordpress.org/plugins/geodirectory

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/29efa17c-fee7-4bd5-b52c-d0ce73bd786c/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000