{"id":"CVE-2026-61992","kind":"vulnerability","aliases":["CVE-2026-61992"],"related":[],"title":"GEO my WordPress plugin: unauthenticated PHP object injection through 4.5.5.3","description":"Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.","summary":"The GEO my WordPress plugin up to version 4.5.5.3 deserializes attacker-supplied PHP objects without authentication. An attacker who sends a crafted request may be able to run code or manipulate the site, with a CVSS score of 9.8.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"geo-my-wp","fixed":["4.5.5.4"],"affected":"<= 4.5.5.3","ecosystem":"wordpress"}],"ecosystems":[],"tags":["geo-my-wordpress","package","php-object-injection","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"Run 'wp plugin get geo-my-wp --field=version' or look under Plugins in wp-admin. Versions 4.5.5.3 and lower are vulnerable.","fix":"Update GEO my WP to 4.5.5.4 or later; 4.5.5.7 is the current release on wordpress.org and also covers later fixes.","status":"open","published_at":"2026-10-29T16:18:11+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","triaged_at":"2026-10-29T16:27:36+00:00","updated_at":"2026-10-29T16:31:38+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T16:27:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"GEO my WordPress plugin: unauthenticated PHP object injection through 4.5.5.3","impact":"high","summary":"The GEO my WordPress plugin up to version 4.5.5.3 deserializes attacker-supplied PHP objects without authentication. An attacker who sends a crafted request may be able to run code or manipulate the site, with a CVSS score of 9.8.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","geo-my-wordpress","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker may run code on the WordPress server","analyst_note":"Check NVD and the plugin's changelog for the fixed version and the exact injectable endpoint or gadget chain; the sources give no fix version.","how_to_check":"- Check the installed version of GEO my WordPress in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug>` if WP-CLI is available.\n- Confirm whether the installed version is `4.5.5.3` or lower.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Any WordPress site running GEO my WordPress at version 4.5.5.3 or lower is exposed, since the flaw needs no login. The sources do not describe a non-default configuration. Sites that do not have the plugin installed can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000684,"input_tokens":4063,"output_tokens":556,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check NVD and the plugin's changelog for the fixed version and the exact injectable endpoint or gadget chain; the sources give no fix version.","search":"'-2026':12A,15A '-61992':13A,16A '4.5.5.3':10A,42B,82C '9.8':73B 'abl':60B 'attack':45B,52B 'attacker-suppli':44B 'authent':50B 'code':63B 'craft':56B 'cve':11A,14A 'cvss':70B 'deseri':43B 'geo':1A,18A,22B,35B,79C 'geo-my-wordpress':21B 'geo-my-wp':17A 'host':32B 'inject':8A,29B,77C 'manipul':65B 'may':58B 'my':19A 'object':7A,28B,48B,76C 'packag':25B 'php':6A,27B,47B,75C 'php-object-inject':26B 'plugin':4A,38B 'request':57B 'run':62B 'score':71B 'self':31B 'self-host':30B 'send':54B 'site':67B 'suppli':46B 'unauthent':5A,74C 'version':41B,83C 'without':49B 'wordpress':3A,24B,33B,37B,81C 'wp':20A","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site with the GEO my WP plugin (slug geo-my-wp) at 4.5.5.3 or lower is exposed, because the flaw needs no login. Whether it leads to code execution depends on a usable gadget chain in the site's other plugins and themes. Sites without the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61992","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61992","severity":null,"published_at":"2026-10-29T16:18:11+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","fetched_at":"2026-10-29T16:25:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-61992:1052","url":null,"severity":null,"published_at":"2026-10-29T16:31:38+00:00","modified_at":"2026-10-29T16:31:38+00:00","first_seen_at":"2026-10-29T16:31:38+00:00","fetched_at":"2026-10-29T16:31:38+00:00","note":"Patchstack (CNA) lists fixed in 4.5.5.4, reported 13 Sep, published 13 Oct 2026; wp.org shows latest 4.5.5.7 (a later Broken Access Control affects <=4.5.5.5, so go to latest). Endpoint/gadget chain not public; no PoC or exploitation found. Not verified: only Patchstack, not the maintainer's changelog entry for 4.5.5.4, was read."}],"documents":[{"id":17750,"url":"https://patchstack.com/database/wordpress/plugin/geo-my-wp/vulnerability/wordpress-geo-my-wordpress-plugin-4-5-5-4-php-object-injection-vulnerability","title":"Patchstack: GEO my WordPress <= 4.5.5.3 PHP Object Injection (CVE-2026-61992)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":17751,"url":"https://wordpress.org/plugins/geo-my-wp/","title":"GEO my WP on wordpress.org (changelog, latest 4.5.5.7)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}