PT-2026-127844

CVE-2026-113494

·

Published

2026-10-28

·

Updated

2026-10-28

Description by

CVSS 3.1
2.7
Low
MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes, allowing users with the Contributor role and above to disclose the content and custom fields of other users' draft, pending, private and trashed listings.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Related identifiers
CVE-2026-113494
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com