CVE-2026-61992
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
PHP Object Injection vulnerability in the GEO my WordPress plugin in versions up to and including 4.5.5.3. It can be exploited by an unauthenticated attacker.
Risk Assessment
An unauthenticated attacker may inject a malicious PHP object, potentially leading to code execution or other serious impacts depending on available gadgets.
Recommendation
Update the GEO my WordPress plugin to a version newer than 4.5.5.3 or apply a mitigation if no update is available.
Other vulnerabilities in GEO my WordPress
See all- CVE-2026-114193High
The GEO my WordPress plugin contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. The issue affects versions from n/a through 4.5.5.5.
- CVE-2026-52715Critical
Versions of GEO my WordPress up to 4.5.5 are vulnerable to unauthenticated SQL Injection.
Original NVD description (English source)
Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS