CVE-2026-113490 GeoDirectory CVE debrief

Who should care

Defenders responsible for WordPress installations with the GeoDirectory plugin should assess exposure and prioritize patching. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and mitigate this vulnerability to prevent potential data exposure.

Why it matters

CVE-2026-113490 allows unauthenticated users to read non-public listing information in the GeoDirectory WordPress plugin. Defenders should prioritize verifying and patching vulnerable instances to prevent potential data exposure.

• Potential unauthorized access to sensitive listing information
• Possible data exposure through listing titles, permalinks, and card fields

Technical summary

The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID. This vulnerability affects WordPress installations with the GeoDirectory plugin, enabling attackers to access sensitive listing information. Defenders should prioritize verifying and patching vulnerable instances to prevent potential data exposure.

Defensive priority

Defenders should prioritize verifying and patching vulnerable GeoDirectory WordPress plugin instances.

Recommended defensive actions

• Verify and patch vulnerable GeoDirectory WordPress plugin instances
• Restrict access to sensitive listing information
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability allows unauthenticated users to read non-public listing information by supplying the listing ID through one of its single-item REST routes. This is possible because the GeoDirectory WordPress plugin before version 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup. The evidence is based on the CVE record and the source-provided CVE metadata. Defenders should verify the affected scope and prioritize patching vulnerable instances.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.