CVE-2026-16988

The GeoDirectory WordPress plugin (versions before 2.8.169 ) is vulnerable to an information disclosure flaw because it fails to perform authorization checks when returning map marker data for a single requested listing via the markers REST endpoint . This allows unauthenticated users to access a...

CVE-2026-16988 GeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST Endpoint

The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public pending or draft listings...