Geo My Wp
Monthly
Local file inclusion and remote code execution in GEO my WP WordPress plugin (≤4.5.5.3) allow unauthenticated attackers to include arbitrary PHP files via the `gmw_posts_locator_ajax_info_window_loader` AJAX handler, which accepted attacker-controlled template paths and passed them to a PHP `require` statement without adequate allowlist enforcement. At minimum this exposes sensitive PHP files such as wp-config.php; when PEAR is installed with `register_argc_argv` enabled, attackers can leverage pearcmd.php to write and execute arbitrary PHP code, achieving full unauthenticated RCE. No public exploit has been identified at time of analysis, though the Wordfence advisory and vulnerable source code are publicly available, substantially reducing the development effort for a proof-of-concept.
SQL injection in the GEO my WP WordPress plugin (versions ≤4.5.5) allows unauthenticated remote attackers to append arbitrary SQL via the 'swlatlng' and 'nelatlng' query-string parameters, enabling extraction of sensitive database contents. The flaw stems from reading parameters directly from $_SERVER['QUERY_STRING'] with parse_str(), bypassing WordPress's wp_magic_quotes sanitization. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV, but exploitation requires only a public page hosting the Posts Locator results shortcode.
GEO my WP WordPress plugin versions before 4.5.5.3 allows any subscriber-level (or higher) authenticated user to modify or permanently delete geolocation records belonging to other users or posts by supplying arbitrary record IDs to two unprotected AJAX actions. The root cause is a complete absence of ownership and capability checks on these endpoints, a textbook CWE-639 IDOR. A publicly available exploit exists per WPScan; however, no public exploit identified at time of analysis corresponds to confirmed active exploitation (not in CISA KEV), and the EPSS score of 0.13% at the 3rd percentile reflects low observed exploitation activity despite POC availability. A vendor-released patch is available in version 4.5.5.3.
Local file inclusion and remote code execution in GEO my WP WordPress plugin (≤4.5.5.3) allow unauthenticated attackers to include arbitrary PHP files via the `gmw_posts_locator_ajax_info_window_loader` AJAX handler, which accepted attacker-controlled template paths and passed them to a PHP `require` statement without adequate allowlist enforcement. At minimum this exposes sensitive PHP files such as wp-config.php; when PEAR is installed with `register_argc_argv` enabled, attackers can leverage pearcmd.php to write and execute arbitrary PHP code, achieving full unauthenticated RCE. No public exploit has been identified at time of analysis, though the Wordfence advisory and vulnerable source code are publicly available, substantially reducing the development effort for a proof-of-concept.
SQL injection in the GEO my WP WordPress plugin (versions ≤4.5.5) allows unauthenticated remote attackers to append arbitrary SQL via the 'swlatlng' and 'nelatlng' query-string parameters, enabling extraction of sensitive database contents. The flaw stems from reading parameters directly from $_SERVER['QUERY_STRING'] with parse_str(), bypassing WordPress's wp_magic_quotes sanitization. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV, but exploitation requires only a public page hosting the Posts Locator results shortcode.
GEO my WP WordPress plugin versions before 4.5.5.3 allows any subscriber-level (or higher) authenticated user to modify or permanently delete geolocation records belonging to other users or posts by supplying arbitrary record IDs to two unprotected AJAX actions. The root cause is a complete absence of ownership and capability checks on these endpoints, a textbook CWE-639 IDOR. A publicly available exploit exists per WPScan; however, no public exploit identified at time of analysis corresponds to confirmed active exploitation (not in CISA KEV), and the EPSS score of 0.13% at the 3rd percentile reflects low observed exploitation activity despite POC availability. A vendor-released patch is available in version 4.5.5.3.