high7.5
CVE-2026-16988
The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowi…
Impact
The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.
Affected products
| Product | Affected versions |
|---|---|
| GeoDirectory WordPress Plugin | before 2.8.169 |
Versions were read from the advisory text. No structured product data has been published for this record yet.