What is the CVSS score of CVE-2026-114193?

CVE-2026-114193 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-114193?

Within 24 hours, identify all instances of the GEO my WordPress plugin across your estate and restrict network access to the affected endpoints if possible. Within 7 days, deactivate and remove the plugin from all sites until a vendor fix is available, or implement additional authorization checks (e.g., via a Web Application Firewall rule) to block unauthorized data access, and monitor logs for exploitation attempts. Within 30 days, evaluate alternative plugins or apply the vendor patch when released, and conduct a security review of all WordPress plugins to ensure timely patching.

GEO my WordPress CVE-2026-114193

EUVD-2026-112732 HIGH

Missing Authorization (CWE-862)

2026-10-29 Patchstack

GHSA-29g2-rhxc-62jx

WordPress Authentication Bypass Geo My Wordpress Wordpress Plugin

7.5

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify site running GEO my WordPress
Exploit

Send request to unprotected plugin endpoint
Execution

Bypass missing authorization check
Impact

Retrieve confidential data

Vulnerability Assessment

Weakness	CWE CWE-862 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Authorization checks on every request MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The description attributes the flaw to 'Incorrectly Configured Access Control Security Levels' (missing authorization) affecting GEO my WordPress up to 4.5.5.5, but the specific vulnerable endpoint, parameter, or feature is not described in the available sources. Consistent with the CVSS vector (PR:N/UI:N/AC:L), no authentication, user interaction, or non-default configuration is indicated as a prerequisite, so a site running an affected plugin version is reachable by a remote unauthenticated attacker. The main limiting factors are that the site must run GEO my WordPress at or below version 4.5.5.5 and that impact is confined to confidentiality (information disclosure); no integrity or availability effect applies.
Impact	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw whose only impact is a high loss of confidentiality - no integrity or availability effect - which is consistent with the CWE-862 Missing Authorization classification and the Patchstack title 'Broken Access Control.' The vuln.today decision label is 'this_week,' indicating elevated but not emergency urgency. No EPSS score, no CISA KEV listing, and no verified public exploit were supplied, so there is no public evidence of active or imminent widespread exploitation; neither were present to contradict the CVSS reading either. The practical risk is therefore a credible unauthenticated data-exposure issue in a WordPress plugin that merits prompt patching this week, but it is not confirmed as actively exploited and the confidentiality-only impact means it is lower priority than an equivalent RCE or data-tampering flaw. One signal to verify: the Tags label this 'Authentication Bypass' while the description and CWE-862 describe missing authorization (an authenticated-or-not access-control gap) rather than a credential/authentication bypass - treat the mechanism as broken access control.
Exploit ScenarioDerived	A remote attacker sends a crafted request directly to a plugin endpoint that fails to enforce an authorization check, and the plugin returns data the requester should not be able to read. Per the CVSS vector no authentication or user interaction is required and attack complexity is low, so the request can be issued against a default-reachable site. No verified public exploit code was provided in the input.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 29, 2026

Missing authorization in the GEO my WordPress plugin through version 4.5.5.5 allows remote unauthenticated attackers to reach data they should not be able to access, producing a high confidentiality impact with no integrity or availability effect. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5), consistent with CWE-862 Missing Authorization and the Patchstack classification as broken access control. No public exploit code and no CISA KEV entry are identified in the available data, and the specific vulnerable endpoint or parameter is not described in the supplied sources.

RemediationAI

The provided data does not identify a fixed release for GEO my WordPress; consult the referenced Patchstack advisory for the vendor's remediation guidance and patched version, and update the plugin as soon as a fixed release is confirmed, since updating is the complete fix for an access-control defect of this kind. If the plugin cannot be updated immediately, disabling or removing GEO my WordPress removes the exposure at the cost of losing its geolocation features; restricting access to the plugin's endpoints may reduce exposure, but the specific vulnerable endpoint is not described in the available sources, so targeted blocking cannot be confirmed.

Affected VersionsENISA

GEO my WordPress 0 ≤4.5.5.5

Affected Packages

euvd geo_my_wordpress no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

GEO my WordPress is a WordPress geolocation plugin maintained by Eyal Fitoussi, represented in the supplied CPE data as cpe:2.3:a:eyal_fitoussi:geo_my_wordpress:*:*:*:*:*:*:*:*. The flaw is CWE-862 Missing Authorization: an access-control decision is absent or incorrectly configured for a plugin feature, so a request that should require authorization is handled without it. The CVSS vector confirms network reachability, low attack complexity, no required privileges, and no user interaction; impact is confined to confidentiality. The trigger, affected endpoint, and parameter are not described in the available sources.

Know when Geo My Wordpress gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI 7.5 HIGH

Missing authorization reachable remotely with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is unauthorized data disclosure only, so C:H, I:N, A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

DescriptionCVE.org

Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5.

Executive ViewAI

Why It Matters

A high-severity vulnerability (CVE-2026-114193) in the GEO my WordPress plugin (versions through 4.5.5.5) allows unauthenticated attackers to bypass authorization controls and access sensitive data, with no integrity or availability impact. This affects all sites running the plugin, potentially exposing confidential information that could damage customer trust, trigger regulatory scrutiny, and harm the organization's reputation.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include restricting access to the vulnerable plugin endpoints, deploying WAF rules to enforce authorization, deactivating the plugin, and monitoring for anomalous data access.

Threat Intelligence Overview

EPSS Score

0.3%

Top 75% exploitable

Prevalence

Medium

common WordPress geolocation plugin, widely installed but not universal

Social Media

Sightings

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.