CVE-2026-16988

The issue affects the GeoDirectory WordPress plugin prior to version 2.8.169. The REST endpoint used to fetch map marker data for a single listing does not perform authorization checks, enabling unauthenticated users to learn the title and exact geographic coordinates of non-public (pending or dr...