CVE-2026-78286

CriticalCVSS 9.8

Published: 27/08/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Summary

The Geo Controller plugin versions up to 8.9.8 contain an unauthenticated PHP Object Injection vulnerability. An attacker can exploit this flaw to execute arbitrary code or perform other unauthorized actions.

Risk Assessment

Risk of taking over the WordPress site or executing malicious code on the server without authentication.

Recommendation

Update the Geo Controller plugin to the latest available version that includes a fix for this vulnerability.

Original NVD description (English source)

Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.