CVE-2026-16968
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The GeoDirectory WordPress plugin before version 2.8.168 does not restrict a user-search handler to users allowed to list users, allowing any authenticated user with Contributor-level access or higher to retrieve the email addresses of all registered users, including administrators.
Risk Assessment
Exposure of all users' email addresses can lead to phishing campaigns, privacy breaches, and potential social engineering attacks on administrators.
Recommendation
Update the plugin to version 2.8.168 or later. Restrict access to the user search functionality to authorized roles only.
Other vulnerabilities in GeoDirectory
See all- CVE-2026-66604High
Unauthenticated Cross Site Scripting (XSS) in GeoDirectory versions up to 2.8.173. An attacker can inject malicious script without authentication.
- CVE-2026-39512Critical
GeoDirectory versions up to 2.8.152 are vulnerable to unauthenticated SQL injection.
- CVE-2026-81271High
Unauthenticated CSRF vulnerability in GeoDirectory plugin versions up to 2.8.176. An attacker can exploit CSRF to perform unwanted actions in the context of a logged-in administrator.
- CVE-2026-68565Medium
Cross Site Scripting (XSS) vulnerability in GeoDirectory versions up to 2.8.172. The attack requires contributor-level privileges.
- CVE-2026-19091High
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). By placing post_type=attachment exclusively in the query string to bypass the consistency check, an attacker can convert an auto-draft GeoDirectory listing into a WordPress attachment with attacker-controlled file paths injected into attachment metadata, which the delete_revision handler then dereferences and unlinks without any post-type or path validation.
- CVE-2026-57681Medium
The GeoDirectory plugin version 2.8.161 and earlier contains a Server-Side Request Forgery (SSRF) vulnerability exploitable by subscribers. This allows an attacker with subscriber privileges to send HTTP requests to internal server resources.
- CVE-2026-42671Medium
The GeoDirectory plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 2.8.157.
Original NVD description (English source)
The GeoDirectory WordPress plugin before 2.8.168 does not restrict a user-search handler to users allowed to list users, allowing any authenticated user with Contributor-level access or higher to retrieve the email addresses of all registered users, including administrators.