Threats tagged 'ghsa-4562-6r2h-7rvw'

A vulnerability in the GeoDirectory WordPress plugin before version 2.8.195 allows users with Contributor role and above to view content and custom fields of other users' draft, pending, private, and trashed listings. This occurs because the plugin does not perform status or ownership checks when rendering listings referenced by an id attribute in its field shortcodes.