EUVD-2026-52173
GHSA-qgxr-8r3m-cw55
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Permanent deletion of records warrants A:L alongside I:L; AV:N and PR:L reflect network-accessible AJAX requiring subscriber auth.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs.
AnalysisAI
GEO my WP WordPress plugin versions before 4.5.5.3 allows any subscriber-level (or higher) authenticated user to modify or permanently delete geolocation records belonging to other users or posts by supplying arbitrary record IDs to two unprotected AJAX actions. The root cause is a complete absence of ownership and capability checks on these endpoints, a textbook CWE-639 IDOR. A publicly available exploit exists per WPScan; however, no public exploit identified at time of analysis corresponds to confirmed active exploitation (not in CISA KEV), and the EPSS score of 0.13% at the 3rd percentile reflects low observed exploitation activity despite POC availability. A vendor-released patch is available in version 4.5.5.3.
Technical ContextAI
GEO my WP is a WordPress geolocation plugin (CPE: cpe:2.3:a:unknown:geo_my_wp:*:*:*:*:*:*:*:*) that registers AJAX actions for logged-in users to manage geolocation data attached to users and posts. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as Insecure Direct Object Reference (IDOR). The two affected AJAX handlers accept a caller-supplied record ID without verifying whether the requesting user owns the targeted record or holds any capability (e.g., edit_others_posts) permitting cross-user modifications. WordPress's subscriber role grants only read-level access to site content, making this a privilege escalation in terms of data ownership - any registered user can act as an administrator over another user's geolocation data. The attack surface is the standard WordPress admin-ajax.php endpoint, accessible over HTTP/HTTPS to any authenticated session.
RemediationAI
Update GEO my WP to version 4.5.5.3 or later; this is the vendor-released patch confirmed by the WPScan advisory at https://wpscan.com/vulnerability/6ba28169-0746-44a4-b622-1cd6b9a65608/. As an immediate compensating control on sites that cannot patch promptly, disabling open user registration eliminates the subscriber-level attacker prerequisite entirely - if registration is not needed, this reduces the exploitable population to zero. If user registration must remain open, consider a WordPress firewall rule (e.g., via Wordfence or similar) blocking unauthenticated and low-privileged access to the specific AJAX action names associated with geolocation record modification; note this requires identifying the exact action hooks from the plugin source, and WAF rules may interfere with legitimate plugin functionality. There are no known side effects from applying the vendor patch.
Local file inclusion and remote code execution in GEO my WP WordPress plugin (≤4.5.5.3) allow unauthenticated attackers
SQL injection in the GEO my WP WordPress plugin (versions ≤4.5.5) allows unauthenticated remote attackers to append arbi
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today