Improper Access Control in GeoDirectory WordPress Plugin
CVE-2026-113494
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 28 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-113494?
The GeoDirectory plugin for WordPress is susceptible to an improper access control vulnerability that allows users with the Contributor role or higher to access and disclose the content, custom fields, and status of other users' listings. This occurs when the plugin renders a listing without verifying the ownership or status of the listing, potentially exposing sensitive information from draft, pending, private, and trashed listings. Immediate action is recommended to secure affected versions of the plugin.
Affected Version(s)
GeoDirectory 0 < 2.8.195
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.