{
 "id": "WPSEC-2026-1625",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1625/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1625/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1625/index.md",
 "title": "GEO my WP <= 4.5.5.5 - Unauthenticated Sensitive Information Exposure via Members Locator Profile Fields",
 "description": "The GEO my WP plugin for WordPress is vulnerable to Sensitive Information Exposure via the Members Locator search results and info windows in all versions up to, and including, 4.5.5.5. This is due to BuddyPress xprofile fields being output without checking their visibility settings, and to member search queries not applying BuddyPress account-status rules. This makes it possible for unauthenticated attackers, on sites using BuddyPress or BuddyBoss with the Members Locator, to view profile field values that members have restricted, and to see inactive or spam accounts in search results.",
 "plugin": {
  "slug": "geo-my-wp",
  "name": "GEO my WP",
  "full_name": "GEO my WP",
  "wordpress_org": "https://wordpress.org/plugins/geo-my-wp/",
  "advisories_url": "https://wpsec.com/vuln/plugin/geo-my-wp/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/geo-my-wp"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.5.5.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.5.5.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.5.5.7",
 "remediation": "Update to 4.5.5.7 or later.",
 "fix_released": "2026-10-23T21:10:18+00:00",
 "published": "2026-10-24T21:41:18+00:00",
 "updated": "2026-10-24T10:52:55.713707+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1625/",
  "https://plugins.svn.wordpress.org/geo-my-wp/tags/4.5.5.7/",
  "https://wordpress.org/plugins/geo-my-wp/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/geo-my-wp",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-25"
 }
}