CVE-2026-16988

The GeoDirectory WordPress plugin prior to version 2.8.169 is vulnerable due to a lack of authorization checks, enabling unauthenticated users to access sensitive information, including the titles and exact geographic coordinates of non-public listings. This exposure could lead to privacy breaches for users with pending or draft listings. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate the risk of unauthorized data disclosure.