What is the CVSS score of CVE-2026-66450?

CVE-2026-66450 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Geo Mashup are affected by CVE-2026-66450?

A high-severity vulnerability in the Geo Mashup WordPress plugin (versions through 1.13.18) allows unauthenticated attackers to access sensitive server files and potentially execute commands without…

How to fix or mitigate CVE-2026-66450?

Within 24 hours, inventory all WordPress sites using Geo Mashup and either completely remove the plugin or implement Web Application Firewall (WAF) rules to block file inclusion attempts. Within 7 days, review server logs from the past month to detect any exploitation attempts, and verify file system permissions to prevent directory traversal access. Within 30 days, transition to an alternative geo-location plugin, establish a policy requiring immediate removal of plugins with unauthenticated vulnerabilities, and deploy file integrity monitoring on configuration files.

Geo Mashup CVE-2026-66450

EUVD-2026-57872 HIGH

PHP Remote File Inclusion (CWE-98)

2026-08-13 Patchstack

GHSA-mqmh-wh52-p9gx

PHP WordPress Information Disclosure LFI Geo Mashup Wordpress Plugin Dylan Kuhn

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable unauthenticated LFI with high complexity; all three impact dimensions high due to potential LFI-to-RCE chain via PHP log poisoning.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:35 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 8.1

DescriptionCVE.org

Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions.

AnalysisAI

Unauthenticated Local File Inclusion in the Geo Mashup WordPress plugin (all versions through 1.13.18) enables a remote, unauthenticated attacker to include arbitrary local files from the server's filesystem, potentially exposing sensitive configuration data or achieving remote code execution through chained techniques such as log poisoning. Reported by Patchstack, the flaw is classified under CWE-98, targeting PHP's include/require mechanism within the plugin. No public exploit or CISA KEV listing has been confirmed at time of analysis, but the CVSS 8.1 score reflects a high-severity, zero-privilege-required attack path.

Technical ContextAI

Geo Mashup (CPE: cpe:2.3:a:dylan_kuhn:geo_mashup:*:*:*:*:*:*:*:*) is a WordPress plugin that renders geographic data on maps using PHP. CWE-98, 'Improper Control of Filename for Include/Require Statement in PHP Program,' describes a class of vulnerability where user-supplied input is passed without sufficient sanitization to PHP's file inclusion functions (include, require, include_once, require_once). In this plugin, a parameter controlling which PHP file is loaded can be manipulated by an unauthenticated remote attacker to traverse the filesystem and include unintended local files. Depending on server configuration and available writable paths, LFI can escalate to Remote Code Execution via log injection, session file inclusion, or other PHP-specific chaining techniques. The high attack complexity (AC:H) in the CVSS vector suggests that reliable exploitation requires non-trivial conditions such as specific server configurations or multi-step chaining.

RemediationAI

The primary remediation is to update the Geo Mashup plugin to a version beyond 1.13.18; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/geo-mashup/vulnerability/wordpress-geo-mashup-plugin-1-13-18-local-file-inclusion-vulnerability for the confirmed fixed version, as an exact patched release number is not independently confirmed in the available intelligence. If an immediate update is not possible, a compensating control is to disable or deactivate the Geo Mashup plugin entirely until patching is feasible, eliminating the attack surface at the cost of losing geographic mapping functionality. Additionally, configuring PHP's open_basedir directive to restrict the file paths PHP can include will limit the traversal depth an attacker can achieve, though this does not eliminate the underlying vulnerability. Web application firewall rules targeting common LFI path traversal sequences (e.g., ../, %2e%2e%2f) in query parameters can reduce exploitation likelihood but may produce false positives on legitimate plugin requests.