CVE-2026-78286: WordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability
Published Aug 27, 2026
·Updated
Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.
Affected Software
1 affected component
wordpress-plugin/geo-controller<=8.9.8
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Geo Controller Pluginto a version that resolves this vulnerability.Fixed in 8.9.9
Event History
Aug 27, 2026
CVE Published
via MITRE·09:00 AM
Data Sourced
via MITRE·09:00 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The issue is unauthenticated, so an attacker does not need a WordPress account or prior privileges to attempt exploitation.
2
What is the potential impact of successful exploitation?
The supplied severity vector indicates network-reachable exploitation with low attack complexity and no user interaction, with high potential impact to confidentiality, integrity, and availability.
3
Which plugin versions are affected?
Geo Controller versions 8.9.8 and earlier are identified as affected.