EUVD-2026-112732
GHSA-29g2-rhxc-62jx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running GEO my WordPress
-
ExploitSend request to unprotected plugin endpoint
-
ExecutionBypass missing authorization check
-
ImpactRetrieve confidential data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The description attributes the flaw to 'Incorrectly Configured Access Control Security Levels' (missing authorization) affecting GEO my WordPress up to 4.5.5.5, but the specific vulnerable endpoint, parameter, or feature is not described in the available sources. Consistent with the CVSS vector (PR:N/UI:N/AC:L), no authentication, user interaction, or non-default configuration is indicated as a prerequisite, so a site running an affected plugin version is reachable by a remote unauthenticated attacker. The main limiting factors are that the site must run GEO my WordPress at or below version 4.5.5.5 and that impact is confined to confidentiality (information disclosure); no integrity or availability effect applies. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw whose only impact is a high loss of confidentiality - no integrity or availability effect - which is consistent with the CWE-862 Missing Authorization classification and the Patchstack title 'Broken Access Control.' The vuln.today decision label is 'this_week,' indicating elevated but not emergency urgency. No EPSS score, no CISA KEV listing, and no verified public exploit were supplied, so there is no public evidence of active or imminent widespread exploitation; neither were present to contradict the CVSS reading either. The practical risk is therefore a credible unauthenticated data-exposure issue in a WordPress plugin that merits prompt patching this week, but it is not confirmed as actively exploited and the confidentiality-only impact means it is lower priority than an equivalent RCE or data-tampering flaw. One signal to verify: the Tags label this 'Authentication Bypass' while the description and CWE-862 describe missing authorization (an authenticated-or-not access-control gap) rather than a credential/authentication bypass - treat the mechanism as broken access control. |
| Exploit ScenarioDerived | A remote attacker sends a crafted request directly to a plugin endpoint that fails to enforce an authorization check, and the plugin returns data the requester should not be able to read. Per the CVSS vector no authentication or user interaction is required and attack complexity is low, so the request can be issued against a default-reachable site. No verified public exploit code was provided in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 29, 2026
Missing authorization in the GEO my WordPress plugin through version 4.5.5.5 allows remote unauthenticated attackers to reach data they should not be able to access, producing a high confidentiality impact with no integrity or availability effect. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5), consistent with CWE-862 Missing Authorization and the Patchstack classification as broken access control. No public exploit code and no CISA KEV entry are identified in the available data, and the specific vulnerable endpoint or parameter is not described in the supplied sources.
RemediationAI
The provided data does not identify a fixed release for GEO my WordPress; consult the referenced Patchstack advisory for the vendor's remediation guidance and patched version, and update the plugin as soon as a fixed release is confirmed, since updating is the complete fix for an access-control defect of this kind. If the plugin cannot be updated immediately, disabling or removing GEO my WordPress removes the exposure at the cost of losing its geolocation features; restricting access to the plugin's endpoints may reduce exposure, but the specific vulnerable endpoint is not described in the available sources, so targeted blocking cannot be confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GEO my WordPress is a WordPress geolocation plugin maintained by Eyal Fitoussi, represented in the supplied CPE data as cpe:2.3:a:eyal_fitoussi:geo_my_wordpress:*:*:*:*:*:*:*:*. The flaw is CWE-862 Missing Authorization: an access-control decision is absent or incorrectly configured for a plugin feature, so a request that should require authorization is handled without it. The CVSS vector confirms network reachability, low attack complexity, no required privileges, and no user interaction; impact is confined to confidentiality. The trigger, affected endpoint, and parameter are not described in the available sources.
Know when Geo My Wordpress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Missing authorization reachable remotely with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is unauthorized data disclosure only, so C:H, I:N, A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5.
Executive ViewAI
A high-severity vulnerability (CVE-2026-114193) in the GEO my WordPress plugin (versions through 4.5.5.5) allows unauthenticated attackers to bypass authorization controls and access sensitive data, with no integrity or availability impact. This affects all sites running the plugin, potentially exposing confidential information that could damage customer trust, trigger regulatory scrutiny, and harm the organization's reputation.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting access to the vulnerable plugin endpoints, deploying WAF rules to enforce authorization, deactivating the plugin, and monitoring for anomalous data access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Geo My Wordpress
View allThe GEO my WP WordPress plugin before 4.5.0.2 does not prevent unauthenticated attackers from including arbitrary files
Unauthenticated SQL injection in the GEO my WordPress plugin versions 4.5.5 and earlier allows remote attackers to injec
The GEO my WP WordPress plugin before 4.5, gmw-premium-settings WordPress plugin before 3.1 does not sufficiently valida
Unauthenticated PHP object injection in the WordPress plugin GEO my WordPress (slug geo-my-wp) at versions 4.5.5.3 and e
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eyal Fitoussi GEO
The GEO my WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to,
Exploit-DB