# Geo Controller <= 9.0.2 - Authenticated (Subscriber+) Missing Authorization to Plugin Integration Support Actions

- **ID:** WPSEC-2026-0963
- **Plugin:** Geo Controller (`cf-geoplugin`), https://wordpress.org/plugins/cf-geoplugin/
- **Affected versions:** all versions before 9.0.3
- **Fixed in:** 9.0.3 (Update to 9.0.3 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/cf-geoplugin
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0963/

## Description

The Geo Controller plugin for WordPress is vulnerable to unauthorized modification of data via the plugin integration support notice in all versions up to, and including, 9.0.2, due to missing capability checks on the cfgp_activate_all_plugins_support() and ajax_dimiss_notice() functions. Both handlers check only a nonce, and that nonce is printed in an admin notice and footer script shown to every logged-in user who opens the dashboard. This makes it possible for authenticated attackers, with subscriber-level access and above, to turn on Geo Controller's integrations with installed supported plugins (such as WooCommerce or Contact Form 7) and to dismiss the integration notice.

## References

- https://wpsec.com/vuln/WPSEC-2026-0963/
- https://plugins.svn.wordpress.org/cf-geoplugin/tags/9.0.3/
- https://wordpress.org/plugins/cf-geoplugin/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0963/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.