{"schema_version":"2","view":"grouped","data":[{"id":56309,"cve_ids":["CVE-2026-113490"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.","evidence":"cve:CVE-2026-113490","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113490","aliases":["CVE-2026-113490"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:54.215Z","provider":"cve","references":["https://wpscan.com/vulnerability/2901f8f3-0b35-4565-b248-6c0dfc5de894/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113490","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:33:27.928810Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:54.215Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:19.138Z"}}},"related_cves":[{"value":"CVE-2026-113490","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:89228764-d18e-4ee5-9665-88436996912b","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113490","advisory_id":"89228764-d18e-4ee5-9665-88436996912b","event_types":["advisory"],"published_at":"2026-10-25T16:12:41.845458+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:19.138+00:00","detail_url":"/advisories/advisory%3A89228764-d18e-4ee5-9665-88436996912b","group":{"id":"advisory:89228764-d18e-4ee5-9665-88436996912b","revision":1,"primary_event_id":55832,"change":"published","superseded_by":[],"changed":{"id":55832,"cve_ids":["CVE-2026-113490"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.","evidence":"cve:CVE-2026-113490","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113490","aliases":["CVE-2026-113490"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:54.215Z","provider":"cve","references":["https://wpscan.com/vulnerability/2901f8f3-0b35-4565-b248-6c0dfc5de894/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113490","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:33:27.928810Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:54.215Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:19.138Z"}}},"related_cves":[{"value":"CVE-2026-113490","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:89228764-d18e-4ee5-9665-88436996912b","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113490","advisory_id":"89228764-d18e-4ee5-9665-88436996912b","event_types":["advisory"],"published_at":"2026-10-25T16:12:41.845458+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:19.138+00:00","detail_url":"/events/55832"},"members":[{"id":55832,"cve_ids":["CVE-2026-113490"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.","evidence":"cve:CVE-2026-113490","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113490","aliases":["CVE-2026-113490"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:54.215Z","provider":"cve","references":["https://wpscan.com/vulnerability/2901f8f3-0b35-4565-b248-6c0dfc5de894/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113490","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:33:27.928810Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:54.215Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:19.138Z"}}},"related_cves":[{"value":"CVE-2026-113490","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:89228764-d18e-4ee5-9665-88436996912b","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113490","advisory_id":"89228764-d18e-4ee5-9665-88436996912b","event_types":["advisory"],"published_at":"2026-10-25T16:12:41.845458+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:19.138+00:00","detail_url":"/events/55832"}]}}],"next_after":56309,"next_before":56309}