CVE-2026-78286

CriticalCVSS 9.8

Published: 27/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.53%

42th percentile - higher than 42% of all known CVEs

Summary

The Geo Controller plugin versions up to 8.9.8 contain an unauthenticated PHP Object Injection vulnerability. An attacker can exploit this flaw to execute arbitrary code or perform other unauthorized actions.

Risk Assessment

Risk of taking over the WordPress site or executing malicious code on the server without authentication.

Recommendation

Update the Geo Controller plugin to the latest available version that includes a fix for this vulnerability.

Other vulnerabilities in Geo Controller

CVE-2025-62109Medium
A vulnerability in the Geo Controller plugin (INFINITUM FORM) allows insertion of sensitive information into sent data, enabling retrieval of embedded sensitive data. The issue affects versions up to and including 8.9.4.

Original NVD description (English source)

Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS