CVE-2026-16968 is an information exposure vulnerability (CWE-200) in the GeoDirectory WordPress plugin. Versions prior to 2.8.168 fail to restrict the user-search handler to users authorized to list users. Consequently, authenticated users with Contributor-level or higher privileges can access email addresses of all registered users, including administrators. This could lead to privacy violations and potentially facilitate targeted phishing or social engineering attacks.

The vulnerability exposes email addresses of all registered users to any authenticated user with Contributor-level access or higher. This compromises user privacy and could aid attackers in crafting targeted attacks against administrators or other users. There is no indication of remote unauthenticated exploitation or direct system compromise from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to user enumeration. Avoid granting unnecessary user privileges that could exploit this vulnerability.