# GEO my WP <= 4.5.5.5 - Unauthenticated Sensitive Information Exposure via AJAX Info Window

- **ID:** WPSEC-2026-1624
- **Plugin:** GEO my WP (`geo-my-wp`), https://wordpress.org/plugins/geo-my-wp/
- **Affected versions:** all versions before 4.5.5.7
- **Fixed in:** 4.5.5.7 (Update to 4.5.5.7 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/geo-my-wp
- **Fix released:** 2026-10-23
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1624/

## Description

The GEO my WP plugin for WordPress is vulnerable to Sensitive Information Exposure via the public 'gmw_info_window_init' AJAX action in all versions up to, and including, 4.5.5.5. This is due to the handler accepting the info-window display settings (template, excerpt source, meta fields, profile fields, location meta) from the user-supplied 'form' array and loading any post or member by the user-supplied object and location IDs. It did not check the post's status, password protection or the visitor's read capability, and did not check that the location belonged to the requested object. This makes it possible for unauthenticated attackers to read the content and other fields of private, draft or password-protected posts, and arbitrary post meta or, on sites using BuddyPress with the Members Locator, arbitrary user meta.

## References

- https://wpsec.com/vuln/WPSEC-2026-1624/
- https://plugins.svn.wordpress.org/geo-my-wp/tags/4.5.5.7/
- https://wordpress.org/plugins/geo-my-wp/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1624/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.