# GEO my WP <= 4.5.5.5 - Unauthenticated Sensitive Information Exposure via Members Locator Profile Fields

- **ID:** WPSEC-2026-1625
- **Plugin:** GEO my WP (`geo-my-wp`), https://wordpress.org/plugins/geo-my-wp/
- **Affected versions:** all versions before 4.5.5.7
- **Fixed in:** 4.5.5.7 (Update to 4.5.5.7 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/geo-my-wp
- **Fix released:** 2026-10-23
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1625/

## Description

The GEO my WP plugin for WordPress is vulnerable to Sensitive Information Exposure via the Members Locator search results and info windows in all versions up to, and including, 4.5.5.5. This is due to BuddyPress xprofile fields being output without checking their visibility settings, and to member search queries not applying BuddyPress account-status rules. This makes it possible for unauthenticated attackers, on sites using BuddyPress or BuddyBoss with the Members Locator, to view profile field values that members have restricted, and to see inactive or spam accounts in search results.

## References

- https://wpsec.com/vuln/WPSEC-2026-1625/
- https://plugins.svn.wordpress.org/geo-my-wp/tags/4.5.5.7/
- https://wordpress.org/plugins/geo-my-wp/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1625/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.