CVE-2026-15260
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The GEO my WP WordPress plugin before version 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions. This allows users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs.
Risk Assessment
The organization risks loss or modification of other users' geolocation data, which can lead to privacy breaches and data integrity issues.
Recommendation
Update the GEO my WP plugin to version 4.5.5.3 or later, which includes proper permission checks.
Other vulnerabilities in GEO my WP
See all- CVE-2026-15300Critical
The GEO my WP plugin for WordPress up to version 4.5.4 is vulnerable to SQL injection via the 'distance', 'lat', and 'lng' parameters. Values are read from $_SERVER['QUERY_STRING'] via parse_str() (bypassing wp_magic_quotes) and passed through esc_sql() into numeric context in the proximity-search query, allowing injection.
- CVE-2026-9757High
The GEO my WP plugin for WordPress up to version 4.5.5 contains an SQL injection vulnerability via the 'swlatlng' and 'nelatlng' parameters, allowing unauthenticated attackers to append additional SQL queries and extract sensitive data. Exploitation requires a public page with the location search results shortcode.
Original NVD description (English source)
The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs.