CVE-2026-16988 in GeoDirectory Plugin
Summary
by MITRE • 08/09/2026
The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/09/2026
The vulnerability in GeoDirectory WordPress plugin versions prior to 2.8.169 represents a critical authorization bypass flaw that undermines the security of location-based listing data. This issue stems from insufficient access controls within the plugin's map marker data retrieval functionality, where the system fails to verify user permissions before exposing sensitive geographic information. The flaw specifically affects the single listing map marker endpoint which is designed to return location data for individual listings. Attackers can exploit this vulnerability by directly accessing the map marker data API endpoint without requiring authentication credentials, thereby gaining unauthorized access to protected listing information.
The technical implementation of this vulnerability resides in the plugin's lack of proper input validation and authorization checks within its REST API endpoints. When a request is made to retrieve map marker data for a specific listing, the system does not verify whether the requesting user has appropriate permissions to view that particular listing. This absence of access control mechanisms creates an information disclosure vulnerability where unauthenticated users can obtain detailed geographic coordinates and listing titles for content that should remain private or restricted. The vulnerability essentially removes any barriers between unauthorized access attempts and sensitive data exposure, making it particularly dangerous in environments where draft or pending listings contain confidential business information.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially compromise business security and privacy. Unauthenticated attackers can systematically harvest geographic coordinates for multiple listings, enabling them to map out business locations, identify patterns in listing submissions, and potentially conduct targeted attacks or surveillance activities. For businesses relying on GeoDirectory for location-based services, this vulnerability exposes their operational data to public scrutiny, potentially affecting competitive positioning, customer privacy, and overall security posture. The exposure of exact geographic coordinates combined with listing titles creates a comprehensive dataset that could be exploited for various malicious purposes including physical security threats, market research, or social engineering attacks.
From a cybersecurity perspective, this vulnerability aligns with CWE-284 (Improper Access Control) and represents a clear violation of the principle of least privilege in access control design. The flaw also maps to ATT&CK technique T1069.001 (Credentials in Files) when attackers attempt to exploit the information disclosure for further reconnaissance, and potentially T1566 (Phishing) if the exposed data is used to craft targeted social engineering campaigns. Organizations should implement immediate mitigations including updating to GeoDirectory version 2.8.169 or later, which includes proper authorization checks for map marker data retrieval. Additional defensive measures such as implementing rate limiting on API endpoints, monitoring access logs for unusual patterns, and restricting direct API endpoint access through firewall rules can further reduce the risk of exploitation.
The remediation approach must address both immediate patching requirements and longer-term architectural improvements to prevent similar issues in other plugin components. System administrators should conduct thorough security audits of all active WordPress plugins to identify potential authorization bypass vulnerabilities, particularly focusing on REST API endpoints that handle sensitive data. The vulnerability serves as a reminder of the critical importance of implementing proper access controls even for seemingly simple data retrieval operations, as the absence of authentication checks can expose entire datasets to unauthorized access. Organizations should also consider implementing automated security scanning tools that can detect similar authorization flaws in their WordPress environments and establish regular security testing procedures to identify and remediate such vulnerabilities before they can be exploited by malicious actors.