CVE-2025-62109

MediumCVSS 5.3

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

19th percentile - higher than 19% of all known CVEs

Summary

A vulnerability in the Geo Controller plugin (INFINITUM FORM) allows insertion of sensitive information into sent data, enabling retrieval of embedded sensitive data. The issue affects versions up to and including 8.9.4.

Risk Assessment

An attacker could intercept sensitive data sent by the plugin, potentially leading to confidentiality breach of user data.

Recommendation

Update the Geo Controller plugin to the latest available version that includes a security fix.

Other vulnerabilities in Geo Controller

CVE-2026-78286Critical
The Geo Controller plugin versions up to 8.9.8 contain an unauthenticated PHP Object Injection vulnerability. An attacker can exploit this flaw to execute arbitrary code or perform other unauthorized actions.

Original NVD description (English source)

Insertion of Sensitive Information Into Sent Data vulnerability in INFINITUM FORM Geo Controller cf-geoplugin allows Retrieve Embedded Sensitive Data.This issue affects Geo Controller: from n/a through <= 8.9.4.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS