Live › vulnerability › CVE-2026-61992
The GEO my WordPress plugin up to version 4.5.5.3 deserializes attacker-supplied PHP objects without authentication. An attacker who sends a crafted request may be able to run code or manipulate the site, with a CVSS score of 9.8.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Any WordPress site with the GEO my WP plugin (slug geo-my-wp) at 4.5.5.3 or lower is exposed, because the flaw needs no login. Whether it leads to code execution depends on a usable gadget chain in the site's other plugins and themes. Sites without the plugin can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| geo-my-wp | wordpress | <= 4.5.5.3 | 4.5.5.4 |
wp plugin get geo-my-wp --field=version or look under Plugins in wp-admin4.5.5.3 and lower are vulnerableUpdate GEO my WP to or later; is the current release on wordpress.org and also covers later fixes.
4.5.5.44.5.5.7Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-61992")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.