The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose th…

Info

CVECVE-2026-16988

First seen2026-08-09 07:15 UTC

Disclosed2026-08-09 06:17 UTC

Last updated2026-08-09 07:15 UTC

Channel statusauto

Summary

The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.

In-depth triage · Auto channel

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Sources

NVD DATABASE

Original Links

https://wpscan.com/vulnerability/162fa8ab-4d80-46f8-9a15-63c8dfd0be33/

Timeline

2026-08-09 nvd_ingest NVD