CVE-2026-114270
CVE-2026-114270 · GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.
CVSS 5.3 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
geodirectory
- Versions
- ≥ 0, < 2.8.197: Affected (semver)
Update to 2.8.197