CVE-2026-16968 Overview
CVE-2026-16968 affects the GeoDirectory WordPress plugin in versions before 2.8.168. The plugin exposes a user-search handler that fails to restrict access to users with the list_users capability. Any authenticated user holding Contributor-level access or higher can enumerate email addresses of all registered users, including administrators. The flaw is categorized as an information exposure issue [CWE-200]. Attackers can leverage the harvested administrator email addresses for targeted phishing, credential stuffing, and password reset abuse. The vulnerability is fixed in GeoDirectory version 2.8.168.
Critical Impact
Contributor-level accounts can extract every registered user's email address, exposing administrators to targeted phishing and account takeover attempts.
Affected Products
- GeoDirectory WordPress plugin versions before 2.8.168
- WordPress sites permitting Contributor-level or higher user registration
- Multi-author WordPress installations using GeoDirectory for location listings
Discovery Timeline
- 2026-08-05 - CVE-2026-16968 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-16968
Vulnerability Analysis
The GeoDirectory plugin registers an AJAX-style user-search handler intended to help administrators assign listings to users. The handler queries the WordPress user database and returns matching user records, including email addresses. The endpoint performs a nonce check but omits a capability check for list_users. Any logged-in account, including Contributor and Author roles, can therefore call the handler and receive email data for every registered user.
The issue falls under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Email addresses of privileged accounts are typically treated as sensitive because they enable targeted phishing and account recovery abuse. The disclosure impacts confidentiality only; the handler does not modify data.
Root Cause
The root cause is a missing authorization check. The plugin validates the request origin using a WordPress nonce but does not call current_user_can( 'list_users' ) before returning user records. WordPress ships this capability to administrators by default, and the plugin should have enforced it before exposing user metadata.
Attack Vector
An attacker first obtains any authenticated session at Contributor level or higher. On sites that allow open registration or guest post submissions, Contributor accounts are often trivially obtained. The attacker then issues a request to the plugin's user-search endpoint with search terms, iterating alphabetic prefixes to enumerate the full user table. The response returns matching users with their email addresses. The attacker uses collected administrator emails to launch targeted phishing or password reset floods against high-value accounts.
No public exploit is currently listed, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-16968
Indicators of Compromise
- Repeated POST requests from Contributor or Author accounts to GeoDirectory AJAX endpoints containing user-search action parameters
- Sequential single-character or alphabetic-prefix search queries suggesting enumeration behavior
- Spikes in admin-ajax.php traffic originating from low-privilege authenticated sessions
- Follow-on phishing emails to administrators referencing accurate internal usernames
Detection Strategies
- Review web server logs for authenticated requests to GeoDirectory user-search actions from non-administrator accounts
- Correlate WordPress audit logs with unusual query patterns from Contributor-level users
- Deploy WAF rules that inspect and rate-limit GeoDirectory AJAX actions when invoked by non-admin roles
Monitoring Recommendations
- Enable a WordPress activity log plugin to capture AJAX action calls with user role context
- Alert on any Contributor or Author account making more than a small threshold of user-search calls per hour
- Monitor outbound bounce traffic and inbound phishing reports referencing site administrator addresses
How to Mitigate CVE-2026-16968
Immediate Actions Required
- Update GeoDirectory to version 2.8.168 or later on all affected WordPress installations
- Audit existing Contributor, Author, and Editor accounts and remove any that are unused or suspicious
- Rotate administrator email addresses or enforce multi-factor authentication on all privileged WordPress accounts
- Review WordPress registration settings and disable open registration where it is not required
Patch Information
The vendor released a fix in GeoDirectory version 2.8.168. The patch adds a current_user_can( 'list_users' ) capability check to the user-search handler, restricting responses to administrators. Refer to the WPScan Vulnerability Detail for additional technical context.
Workarounds
- Temporarily deactivate the GeoDirectory plugin until the update to 2.8.168 is applied
- Restrict /wp-admin/admin-ajax.php access by role using a security plugin or custom mu-plugin filter
- Block Contributor and Author roles from calling GeoDirectory AJAX actions via WAF rules
# Update GeoDirectory via WP-CLI on the affected host
wp plugin update geodirectory --version=2.8.168
wp plugin list --name=geodirectory --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
