{
 "id": "WPSEC-2026-0963",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0963/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0963/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0963/index.md",
 "title": "Geo Controller <= 9.0.2 - Authenticated (Subscriber+) Missing Authorization to Plugin Integration Support Actions",
 "description": "The Geo Controller plugin for WordPress is vulnerable to unauthorized modification of data via the plugin integration support notice in all versions up to, and including, 9.0.2, due to missing capability checks on the cfgp_activate_all_plugins_support() and ajax_dimiss_notice() functions. Both handlers check only a nonce, and that nonce is printed in an admin notice and footer script shown to every logged-in user who opens the dashboard. This makes it possible for authenticated attackers, with subscriber-level access and above, to turn on Geo Controller's integrations with installed supported plugins (such as WooCommerce or Contact Form 7) and to dismiss the integration notice.",
 "plugin": {
  "slug": "cf-geoplugin",
  "name": "Geo Controller",
  "full_name": "Geo Controller",
  "wordpress_org": "https://wordpress.org/plugins/cf-geoplugin/",
  "advisories_url": "https://wpsec.com/vuln/plugin/cf-geoplugin/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/cf-geoplugin"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "9.0.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 9.0.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "9.0.3",
 "remediation": "Update to 9.0.3 or later.",
 "fix_released": "2026-10-13T19:38:57+00:00",
 "published": "2026-10-14T19:42:49+00:00",
 "updated": "2026-10-14T14:18:05.544224+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0963/",
  "https://plugins.svn.wordpress.org/cf-geoplugin/tags/9.0.3/",
  "https://wordpress.org/plugins/cf-geoplugin/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/cf-geoplugin",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-14"
 }
}