What is GHSA-jj25-wjr9-4f42?

GHSA-jj25-wjr9-4f42 is a security advisory published by GitHub Security Advisories with Medium severity. The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password...

Which CVE IDs does GHSA-jj25-wjr9-4f42 cover?

GHSA-jj25-wjr9-4f42 covers the following CVE IDs: CVE-2026-113492. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jj25-wjr9-4f42?

GHSA-jj25-wjr9-4f42 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-jj25-wjr9-4f42MediumCVSS 5.3

The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password...

Vendor

GitHub Security Advisories

Published

October 24, 2026

Last Modified

October 24, 2026

🔗 CVE IDs covered (1)

CVE-2026-113492 →

📋 Description

The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-113492
https://wpscan.com/vulnerability/5a1c17a0-c513-4f64-91c7-09c0f1878c71
https://github.com/advisories/GHSA-jj25-wjr9-4f42