CVE-2026-16988

GeoDirectory versions prior to a recent patch exposed precise geographic coordinates of draft and pending listings to any unauthenticated requester. This is not a broken authentication scenario in the traditional sense — the plugin never implemented any access control on the map marker endpoint at all. Instead, the developer treated coordinate data as rendering infrastructure rather than content, assuming that unpublished listings were implicitly private simply because they lacked a public URL. The practical consequence: anyone can enumerate listing IDs (they are sequential) and retrieve exact GPS coordinates for listings the site owner has not yet published. This includes properties not yet on the market, businesses preparing soft launches, or locations explicitly marked private. The attacker needs no tools beyond curl and a basic script — this is zero-skill, mass-harvestable reconnaissance. The CVSS 7.5 score is underweight. It measures technical disclosure severity without modeling what that disclosure enables: physical reconnaissance for targeted break-ins, competitive intelligence on unpublished properties, stalking vectors when listings represent personal practices, and social engineering precision from knowing business addresses before they're public. The geographic dimension transforms this from a data disclosure into a physical-security exposure. For defenders: patch the plugin immediately, but understand that patching one endpoint does not fix the underlying architectural assumption. Audit the plugin for other AJAX or REST endpoints that may return unpublished metadata — descriptions, images, contact information — using the same draft-as-privacy mental model. If your directory handles sensitive categories (healthcare providers, private residences, construction sites), treat this as an incident-response trigger rather than a routine patch cycle. The exposed coordinates may have already been harvested by scrapers running continuous enumeration against your site.

Reviewed through automated stages and approved by a human before publication.