CVE-2026-114193: WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/geo-my-wpto a version that resolves this vulnerability.Fixed in 4.5.5.7
Event History
Frequently Asked Questions
Which deployments are affected?
GEO my WordPress versions through 4.5.5.5 are affected. The available data does not identify a fixed version or any configuration that is exempt.
Can this be exploited remotely without an account or user interaction?
Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the expected impact of successful exploitation?
The reported impact is high confidentiality impact, with no stated integrity or availability impact. The vulnerability is classified as broken access control caused by missing authorization.