Description

The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-09T06:17:55.887Z",
  "pubdate": "2026-08-09T06:17:55.887Z",
  "executiveSummary": "The GeoDirectory WordPress plugin prior to version 2.8.169 suffers from an authorization bypass vulnerability affecting map marker data retrieval for single requested listings. This security flaw enables unauthenticated malicious actors to query and disclose sensitive metadata, specifically the title and exact geographic coordinates, belonging to non-public listings such as those in pending or draft states. The root cause stems from the complete absence of proper access control and authorization checks during the processing of map marker data requests. Consequently, the risk implications include unauthorized information exposure of sensitive, unpublished business data and internal operational details. Attackers require no prior authentication or specific privileges to exploit this vulnerability, as the affected endpoint is exposed over the network and accessible to any unauthenticated user. Exploitation is straightforward, requiring a crafted request to the vulnerable component to harvest restricted geographic data without interacting with the WordPress administrative interface.",
  "technicalDetails": "The vulnerability resides within the map marker data retrieval mechanism of the GeoDirectory WordPress plugin affecting versions prior to 2.8.169. The root cause of the security issue is the failure of the application logic to validate whether the requesting user possesses the necessary authorization or administrative capabilities to view non-public content. In WordPress architecture, posts, custom post types, and listings in pending, draft, or private states are restricted to authorized users with appropriate capabilities such as edit_posts or higher. However, the affected endpoint fails to enforce these checks before querying the database and serializing the results for map rendering.\nThe attack flow proceeds as follows: An unauthenticated attacker identifies the network endpoint responsible for returning map marker data for a single requested listing. By sending a crafted HTTP request targeting this component, the attacker bypasses standard WordPress visibility filters. The vulnerable component queries the database for the specified listing ID without validating its post status. Because the authorization check is omitted, the backend processes the request and returns the sensitive listing metadata in the response payload. The returned data includes precise geographic coordinates (latitude and longitude) and the corresponding listing title associated with the draft or pending entry.\nThe network exposure of this vulnerability is public, as the affected functionality is accessible over standard web protocols (HTTP/HTTPS) without session validation. The attacker requires no privileges, meaning any external entity on the internet can execute the attack vector. The post-exploitation impact is characterized by unauthorized information disclosure, allowing threat actors to systematically enumerate and harvest confidential geographic intelligence and unpublished listing titles intended solely for internal review or administrative staging."
}