CVE-2024-6330: GEO my WordPress < 4.4.0.2 - Unauthenticated RCE via LFI
Published Aug 19, 2024
·Updated
The GEO my WP WordPress plugin before 4.5.0.2 does not prevent unauthenticated attackers from including arbitrary files in PHP's execution context, which leads to Remote Code Execution.
Affected Software
2 affected components
GEO my WP WordPress plugin<4.5.0.2
Geomywp Geo My Wordpress Wordpress<4.5.0.2
Event History
Aug 19, 2024
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2024-6330?
The severity of CVE-2024-6330 is critical due to its potential for remote code execution by unauthenticated attackers.
2
How do I fix CVE-2024-6330?
To fix CVE-2024-6330, update the GEO my WP WordPress plugin to version 4.5.0.2 or later.
3
What type of vulnerability is CVE-2024-6330?
CVE-2024-6330 is a remote code execution vulnerability caused by improper file inclusion in the GEO my WP WordPress plugin.
4
Who is affected by CVE-2024-6330?
Users of the GEO my WP WordPress plugin versions prior to 4.5.0.2 are affected by CVE-2024-6330.
5
What are the consequences of CVE-2024-6330 exploitation?
If exploited, CVE-2024-6330 allows attackers to execute arbitrary PHP code on the affected WordPress sites.