CVE-2026-16988: CWE-200 Information Exposure in GeoDirectory
The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.
AI Analysis
Technical Summary
The GeoDirectory WordPress plugin prior to version 2.8.169 does not enforce authorization when returning map marker data for a single requested listing. This allows unauthenticated users to retrieve sensitive information such as the title and precise geographic coordinates of listings that are not public, including those in pending or draft status. This vulnerability is classified as CWE-200 (Information Exposure) and has a CVSS 3.1 base score of 7.5, indicating high severity.
Potential Impact
An attacker can obtain sensitive information about non-public listings, including their titles and exact geographic locations, without any authentication. This exposure could lead to privacy violations or other indirect impacts but does not affect integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the GeoDirectory plugin updates and apply the update to version 2.8.169 or later once available to remediate this issue.
CVE-2026-16988: CWE-200 Information Exposure in GeoDirectory
Description
The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.
CVSS v3.1
Score 7.5high
Affected software
GeoDirectory
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The GeoDirectory WordPress plugin prior to version 2.8.169 does not enforce authorization when returning map marker data for a single requested listing. This allows unauthenticated users to retrieve sensitive information such as the title and precise geographic coordinates of listings that are not public, including those in pending or draft status. This vulnerability is classified as CWE-200 (Information Exposure) and has a CVSS 3.1 base score of 7.5, indicating high severity.
Potential Impact
An attacker can obtain sensitive information about non-public listings, including their titles and exact geographic locations, without any authentication. This exposure could lead to privacy violations or other indirect impacts but does not affect integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the GeoDirectory plugin updates and apply the update to version 2.8.169 or later once available to remediate this issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-24T08:46:07.377Z
- State
- PUBLISHED
Threat ID: 6a781a2ebf8831d5391ffee1
Added to database: 08/09/2026, 06:11:58 UTC
Last enriched: 08/16/2026, 14:47:13 UTC
Last updated: 09/23/2026, 13:47:42 UTC
Views: 39
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.