CVE-2026-16988 Overview
CVE-2026-16988 is an information disclosure vulnerability in the GeoDirectory WordPress plugin versions prior to 2.8.169. The plugin fails to perform authorization checks when returning map marker data for a single requested listing. Unauthenticated attackers can retrieve the title and exact geographic coordinates of non-public listings, including those in pending or draft status. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated remote attackers can enumerate non-public GeoDirectory listings and disclose their exact geographic coordinates without any user interaction.
Affected Products
- GeoDirectory WordPress plugin versions prior to 2.8.169
- WordPress sites using GeoDirectory for location-based directory listings
- Any deployment exposing the affected map marker endpoint to unauthenticated requests
Discovery Timeline
- 2026-08-09 - CVE-2026-16988 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-16988
Vulnerability Analysis
The GeoDirectory plugin exposes an endpoint that returns map marker data for individual listings. This endpoint accepts a listing identifier and responds with the listing title and geographic coordinates. The endpoint does not validate whether the requesting user is authorized to view the referenced listing. As a result, listings that are pending moderation or saved as drafts return the same detailed marker data as published entries.
Attackers can iterate through listing identifiers to enumerate non-public content. The disclosed data includes exact latitude and longitude values, which is particularly sensitive for directories containing private residences, protected locations, or listings awaiting moderation review.
Root Cause
The root cause is a missing authorization check in the map marker request handler. The code path retrieves listing metadata and returns marker data without verifying the post status of the requested listing. WordPress typically restricts access to non-published posts based on capability checks such as read_private_posts or ownership validation. The affected function bypasses these checks entirely, treating all listings as publicly accessible when queried through the marker endpoint.
Attack Vector
Exploitation requires only network access to the affected WordPress site. An attacker sends unauthenticated HTTP requests to the map marker endpoint with sequential or enumerated listing IDs. The response contains the title and coordinates of any listing matching the identifier, regardless of its publication status. No authentication credentials, user interaction, or elevated privileges are required. The vulnerability affects confidentiality only; integrity and availability remain unaffected.
A proof-of-concept exploitation flow is described in the WPScan Vulnerability Report. Refer to the advisory for endpoint parameters and response structure.
Detection Methods for CVE-2026-16988
Indicators of Compromise
- Unauthenticated HTTP requests to the GeoDirectory map marker endpoint containing sequential or enumerated post_id parameters
- High-volume request patterns from a single source targeting the plugin's AJAX or REST endpoints
- Anomalous access to listings with pending or draft post status via marker requests
Detection Strategies
- Review web server access logs for repeated GET or POST requests to GeoDirectory AJAX actions returning marker data
- Correlate WordPress post status against endpoint responses to identify disclosure of non-published listings
- Monitor for user-agent strings and IP addresses generating burst requests against the plugin endpoints
Monitoring Recommendations
- Ingest WordPress and web server logs into a centralized SIEM for pattern-based detection
- Alert on unauthenticated request bursts to plugin-specific endpoints exceeding a defined rate threshold
- Track changes to plugin version metadata to confirm patched deployments across managed sites
How to Mitigate CVE-2026-16988
Immediate Actions Required
- Update the GeoDirectory plugin to version 2.8.169 or later on all affected WordPress installations
- Audit web server logs for prior unauthenticated access to the map marker endpoint
- Review non-public listings to assess whether sensitive coordinate data may have been disclosed
Patch Information
The vendor addressed CVE-2026-16988 in GeoDirectory version 2.8.169. The patch introduces authorization checks that validate the post status and requester permissions before returning marker data for a requested listing. Site administrators should apply the update through the WordPress plugin management interface or via WP-CLI. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Restrict access to the GeoDirectory map marker endpoint using a web application firewall rule that blocks unauthenticated requests
- Temporarily disable the GeoDirectory plugin on sites unable to apply the patch immediately
- Remove sensitive coordinate data from non-public listings until the patched version is deployed
# Update GeoDirectory to the patched version via WP-CLI
wp plugin update geodirectory --version=2.8.169
wp plugin list --name=geodirectory --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
