# CVE-2026-113494: GeoDirectory WordPress plugin information disclosure via shortcode

Source: https://junglewise.ai/threats/cve-2026-113494-the-geodirectory-wordpress-plugin-before-2-8-195-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-113494 · Severity: info · Published 2026-10-28

GeoDirectory is a WordPress plugin for managing business listings and directory information. The plugin fails to verify user permissions when displaying listings through shortcodes, allowing contributors and higher-privileged users to view draft, pending, private, and trashed listings that belong to other users, exposing sensitive business data and custom fields.

Technologies: [GeoDirectory](https://junglewise.ai/threats/technologies/geodirectory-geodirectory). Vendors: [GeoDirectory](https://junglewise.ai/threats/vendors/geodirectory).

## Quick answers

**Is CVE-2026-113494 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113494 being exploited in the wild.

**How severe is CVE-2026-113494?** Informational severity, published 28 October 2026.

**Which products and versions are affected?** GeoDirectory before 2.8.195.

**Is there a fix for CVE-2026-113494?** Yes: fixed in 2.8.195. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-113494 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-113494?** Check whether you run GeoDirectory at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.8.195

## Technical details

The gd_post_content shortcode in GeoDirectory does not perform status or ownership validation when rendering listings referenced by an ID parameter, allowing authenticated users with Contributor role or above to retrieve non-public content belonging to other users. This is an information disclosure vulnerability (CWE-200) affecting the shortcode rendering logic with no special preconditions beyond having a Contributor account on the WordPress instance. A fix is available in version 2.8.195.

## Affected products

- GeoDirectory GeoDirectory before 2.8.195

## Timeline

- 2026-10-26: disclosed
- 2026-10-28: advisory

## References

- [https://wpscan.com/vulnerability/29efa17c-fee7-4bd5-b52c-d0ce73bd786c/](https://wpscan.com/vulnerability/29efa17c-fee7-4bd5-b52c-d0ce73bd786c/)

## Related threats

- [GeoDirectory WordPress plugin password-protected listing disclosure](https://junglewise.ai/threats/cve-2026-114270-the-geodirectory-wordpress-plugin-before-2-8-197-does-not-honour)
- [GeoDirectory WordPress plugin stored XSS in post badge shortcode](https://junglewise.ai/threats/cve-2026-113488-the-geodirectory-wordpress-plugin-before-2-8-196-does-not)
- [GeoDirectory WordPress plugin stored XSS in post badge link](https://junglewise.ai/threats/cve-2026-113487-the-geodirectory-wordpress-plugin-before-2-8-196-does-not)
- [GeoDirectory WordPress plugin authorization bypass in guest listing](https://junglewise.ai/threats/cve-2026-113674-the-geodirectory-wordpress-plugin-before-2-8-194-does-not)
- [GeoDirectory WordPress plugin RCE via DB text export](https://junglewise.ai/threats/cve-2026-113673-the-geodirectory-wordpress-plugin-before-2-8-194-does-not)