GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.8.194
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
The GeoDirectory WordPress plugin is affected, specifically its map-popup REST endpoint for individual listings. An unauthenticated attacker can view the title, link, and card details of listings that are not publicly published, such as drafts, pending, private, or trashed entries, simply by knowing the listing ID.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- Unknown GeoDirectory
fixed in 2.8.194