Vulnerabilities / GEO my WP / WPSEC-2026-1625
GEO my WP <= 4.5.5.5 - Unauthenticated Sensitive Information Exposure via Members Locator Profile Fields
Medium 5.3
CWE-200Fixed in 4.5.5.7
- ID
- WPSEC-2026-1625
- Plugin
- GEO my WP (geo-my-wp)
- Affected
- all versions before 4.5.5.7
- Remediation
- Update to 4.5.5.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-25
- Attack surface
- GEO my WP on WPSec AttackSurface
- Fix released
- Published
Description
The GEO my WP plugin for WordPress is vulnerable to Sensitive Information Exposure via the Members Locator search results and info windows in all versions up to, and including, 4.5.5.5. This is due to BuddyPress xprofile fields being output without checking their visibility settings, and to member search queries not applying BuddyPress account-status rules. This makes it possible for unauthenticated attackers, on sites using BuddyPress or BuddyBoss with the Members Locator, to view profile field values that members have restricted, and to see inactive or spam accounts in search results.
References
- https://wpsec.com/vuln/WPSEC-2026-1625/
- https://plugins.svn.wordpress.org/geo-my-wp/tags/4.5.5.7/
- https://wordpress.org/plugins/geo-my-wp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS