THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-16988 — The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listing

[NVD] CVE-2026-16988 — The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listing

mednvdPublished 2026-08-09

CVE-2026-16988 CVSS: None Published: 2026-08-09T06:17:55.887

The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.

Indicators of compromise

CVE-2026-16988cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-16988