CVE-2026-113494 GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode

The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes, allowing users with the Contributor role and above to disclose the content and custom fields of other users' draft,...

CVE-2026-113494

The GeoDirectory WordPress plugin (versions prior to 2.8.195 ) is vulnerable to unauthorized information disclosure. The root cause is a lack of status or ownership checks when the plugin renders a listing referenced via an id attribute in its field shortcodes . This flaw allows users with a Cont...