GEO my WP <= 4.5.5.5 - Unauthenticated Sensitive Information Exposure via AJAX Info Window
- ID
- WPSEC-2026-1624
- Plugin
- GEO my WP (geo-my-wp)
- Affected
- all versions before 4.5.5.7
- Remediation
- Update to 4.5.5.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-25
- Attack surface
- GEO my WP on WPSec AttackSurface
- Fix released
- Published
Description
The GEO my WP plugin for WordPress is vulnerable to Sensitive Information Exposure via the public 'gmw_info_window_init' AJAX action in all versions up to, and including, 4.5.5.5. This is due to the handler accepting the info-window display settings (template, excerpt source, meta fields, profile fields, location meta) from the user-supplied 'form' array and loading any post or member by the user-supplied object and location IDs. It did not check the post's status, password protection or the visitor's read capability, and did not check that the location belonged to the requested object. This makes it possible for unauthenticated attackers to read the content and other fields of private, draft or password-protected posts, and arbitrary post meta or, on sites using BuddyPress with the Members Locator, arbitrary user meta.
References
- https://wpsec.com/vuln/WPSEC-2026-1624/
- https://plugins.svn.wordpress.org/geo-my-wp/tags/4.5.5.7/
- https://wordpress.org/plugins/geo-my-wp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS