PT-2026-130646

CVE-2026-114270

Published

2026-10-27

Updated

2026-10-29

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GeoDirectory versions prior to 2.8.197

Description The plugin fails to honor post password protection when rendering a listing. This allows unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password, potentially leading to the exposure of sensitive user or configuration data.

Recommendations Update to version 2.8.197 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Erwan Lr

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers