Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-16988: GeoDirectory plugin - Unauthenticated access to private listings
CVE-2026-16988 · published 26 days ago
Summary
The GeoDirectory WordPress plugin for websites has a security issue that allows anyone to see private listings, including their exact location. This is a concern for businesses that use private listings to manage their online presence. To fix this, update the plugin to version 2.8.169 or later.
What to do
- Update unknown geodirectory to version 2.8.169 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | geodirectory | < 2.8.169 |
Original advisory text
GeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST Endpoint
The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.
References
- https://wpscan.com/vulnerability/162fa8ab-4d80-46f8-9a15-63c8dfd0be33/ exploit vdb-entry technical-description
Severity
7.5
High
Exploitation
EPSS <1%
Type
CWE-200Information Exposure
Timeline
Published9 Aug 2026
Updated29 Aug 2026
First seen9 Aug 2026
Monitor software like this
Free during beta