CVE-2026-85200: GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion
The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmwpostslocatorajaxinfowindowloader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. In environments where PEAR is installed with registerargcargv enabled, this file inclusion can be leveraged to write and execute arbitrary PHP code, achieving full remote code execution.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
All GEO my WP plugin versions up to and including 4.5.5.3 are affected. The vulnerable functionality is in the Posts Locator component.
Does exploitation require a WordPress account or user interaction?
No. The issue is exploitable by an unauthenticated attacker and does not require user interaction.
What must be present for this to result in code execution?
The inclusion primitive can execute PHP files already available on the server. Full remote code execution is possible when PEAR is installed and register_argc_argv is enabled, because the inclusion can then be used to write and execute arbitrary PHP code.
What impact is possible if exploitation succeeds?
An attacker may bypass access controls, obtain sensitive data, or execute PHP code from included files. In the PEAR and register_argc_argv scenario, the impact can escalate to full remote code execution.