An authorization bypass in the GeoDirectory WordPress plugin allows unauthenticated attackers to view sensitive, non-public geographic and listing information.

The plugin fails to perform necessary capability checks when responding to requests for map marker data. This allows unauthenticated users to query the REST API and retrieve titles and geographic coordinates for listings that should be restricted to draft or pending status.

This vulnerability enables unauthorized access to potentially sensitive business information, such as upcoming listing locations or internal project data. With a CVSS score of 7.5, the ease of exploitation (unauthenticated, network-based) makes this an attractive target for data harvesting. The exposure of non-public listings can lead to reputational damage and the loss of competitive advantage.

Immediate Action: Update the GeoDirectory plugin to version 2.8.169 or later immediately.

Proactive Monitoring: Review web server access logs for anomalous requests to the markers REST API endpoint, particularly those originating from unknown or suspicious IP addresses.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block unauthorized requests to the vulnerable REST endpoint until the plugin can be patched.

Public Exploit Available: Yes, public proof-of-concept code exists.

The ability to extract non-public data without authentication makes this a critical security priority for any site running GeoDirectory. Administrators should apply the 2.8.169 update immediately to close the API exposure and prevent the unauthorized disclosure of sensitive listing information.