Geo Controller CVE-2026-78286

Exploitation requires that the Geo Controller (cf-geoplugin) plugin at version 8.9.8 or earlier is installed and active on the target WordPress site, and that the attacker can reach the request parameter the plugin passes to PHP deserialization - per the CVSS vector this is remotely reachable with no authentication and no user interaction (AV:N/PR:N/UI:N). The key limiting factor is inherent to PHP Object Injection: achieving code execution or high-impact outcomes depends on a usable POP gadget chain existing in the loaded plugin/theme/core code; without a suitable gadget, impact may be limited to lower-severity effects. Exploitation is otherwise unconstrained against default configurations where the plugin is enabled.

The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), meaning network-reachable, low-complexity, and unauthenticated - the profile that typically warrants prompt remediation. That said, the practical severity of PHP Object Injection almost always hinges on whether a reachable gadget chain is present; the raw CVSS does not reflect that dependency, so the real-world impact can range from denial-of-service to full RCE depending on the deployed plugin/theme stack. No EPSS score, KEV listing, or POC was provided, so exploitation probability cannot be quantified from the input and there is no public exploit identified at time of analysis - this tempers immediate urgency relative to the 9.8 score but does not lower the theoretical impact. Given the unauthenticated network vector, any team running Geo Controller <= 8.9.8 on an internet-facing WordPress site should treat this as a high-priority patch item and not defer it merely because active exploitation is unconfirmed.

An unauthenticated attacker sends a crafted HTTP request to a Geo Controller endpoint with a malicious serialized PHP object in a parameter that the plugin passes to unserialize(). If a compatible gadget chain is available in the WordPress stack, the deserialization triggers magic methods that lead to file writes or code execution, giving the attacker control over the site. No public exploit is identified at time of analysis, but the low attack complexity and lack of authentication make this straightforward to attempt at scale.