CVE-2026-61992: WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability

Q: Does exploitation require an account or user interaction?

No. The CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What could a successful exploit allow an attacker to do?

The reported CVSS impact is high for confidentiality, integrity, and availability. This indicates potential exposure of data, modification of data, and service disruption.

Q: Which plugin versions should be treated as affected?

The supplied data is inconsistent: the title identifies versions through 4.5.5.4, while the description identifies versions through 4.5.5.3. Verify the installed GEO my WordPress version and treat this discrepancy conservatively until authoritative version guidance is available.

Published Oct 29, 2026

Updated

Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.

Event History

Oct 29, 2026

CVE Published

via MITRE·03:24 PM

Data Sourced

via MITRE·03:24 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require an account or user interaction?

No. The CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.

What could a successful exploit allow an attacker to do?

The reported CVSS impact is high for confidentiality, integrity, and availability. This indicates potential exposure of data, modification of data, and service disruption.

Which plugin versions should be treated as affected?

The supplied data is inconsistent: the title identifies versions through 4.5.5.4, while the description identifies versions through 4.5.5.3. Verify the installed GEO my WordPress version and treat this discrepancy conservatively until authoritative version guidance is available.

CVE-2026-61992: WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability

Event History

Frequently Asked Questions

Does exploitation require an account or user interaction?

What could a successful exploit allow an attacker to do?

Which plugin versions should be treated as affected?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require an account or user interaction?

What could a successful exploit allow an attacker to do?

Which plugin versions should be treated as affected?