Description
The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | GeoDirectory | < 2.8.197 | 2.8.197 |
References
- https://wpscan.com/vulnerability/1d217334-b749-4abd-9d95-4941cd69ae55/ exploit vdb-entry technical-description