GEO my WordPress CVE-2026-61992

The input states the flaw is unauthenticated PHP Object Injection affecting GEO my WordPress (plugin slug geo-my-wp) versions <= 4.5.5.3, consistent with AV:N/AC:L/PR:N/UI:N - i.e., remotely reachable without credentials or user interaction against affected installations. The precise feature, parameter, or endpoint that unserializes attacker input is not described in the available sources. The principal real-world limiting factor for CWE-502 is that meaningful impact (RCE/file/data operations) depends on a reachable POP gadget chain in the plugin or loaded code; that chain is not documented here. Exploitation is further limited to sites running version 4.5.5.3 or earlier, since 4.5.5.4 is indicated as the fixed release.

This is a genuine high-priority issue, though several corroborating signals are absent. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality, integrity and availability impact, yielding a 9.8 base score - the worst-case profile for a WordPress plugin. The vuln.today decision label is 'act_now', and the issue is CWE-502 (deserialization / PHP Object Injection), a class that can escalate to remote code execution, arbitrary file operations or data tampering WHEN a suitable POP gadget chain is present in the plugin or its loaded dependencies. However, the real-world impact of a PHP Object Injection bug is gated on the availability of such a gadget chain, which the available sources do NOT describe, so the CIA:H rating represents the credible worst case rather than a demonstrated outcome. No EPSS score, no CISA KEV listing, and no verified public exploit code were provided; absence of these is not evidence of safety but means widespread automated exploitation is not yet confirmed. Net: treat as a real, urgent patch priority driven by the unauthenticated network vector and 'act_now' label, not as a low-real-risk high-CVSS artifact - but note that no active exploitation or working exploit has been confirmed in the input.

A remote attacker sends a crafted request to the public-facing GEO my WordPress endpoint that unserializes attacker-controlled input, injecting a malicious PHP object. If a usable gadget chain is reachable, the object is deserialized during normal processing and abused to achieve code execution or file/data manipulation on the WordPress host. No authentication or user interaction is required per the CVSS vector; the exact trigger is not described in the available sources, and no verified public exploit code was provided.