Geo Controller <= 9.0.2 - Authenticated (Subscriber+) Missing Authorization to Plugin Integration Support Actions
- ID
- WPSEC-2026-0963
- Plugin
- Geo Controller (cf-geoplugin)
- Affected
- all versions before 9.0.3
- Remediation
- Update to 9.0.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-14
- Attack surface
- Geo Controller on WPSec AttackSurface
- Fix released
- Published
Description
The Geo Controller plugin for WordPress is vulnerable to unauthorized modification of data via the plugin integration support notice in all versions up to, and including, 9.0.2, due to missing capability checks on the cfgp_activate_all_plugins_support() and ajax_dimiss_notice() functions. Both handlers check only a nonce, and that nonce is printed in an admin notice and footer script shown to every logged-in user who opens the dashboard. This makes it possible for authenticated attackers, with subscriber-level access and above, to turn on Geo Controller's integrations with installed supported plugins (such as WooCommerce or Contact Form 7) and to dismiss the integration notice.
References
- https://wpsec.com/vuln/WPSEC-2026-0963/
- https://plugins.svn.wordpress.org/cf-geoplugin/tags/9.0.3/
- https://wordpress.org/plugins/cf-geoplugin/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS