CVE-2026-15260 in GEO my WP Plugin
Summary
by MITRE • 08/03/2026
The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability in the GEO my WP WordPress plugin affects versions prior to 4.5.5.3 and represents a critical authorization flaw that undermines the security of geolocation data management within WordPress environments. This issue stems from insufficient access control mechanisms implemented in two specific AJAX endpoints that handle geolocation record modifications. The flaw allows authenticated users with subscriber-level permissions or higher to exploit these unprotected interfaces and manipulate geolocation data belonging to other users or posts, creating a significant privilege escalation vector within the plugin's functionality.
The technical implementation of this vulnerability involves the absence of proper capability checks within the AJAX action handlers that process geolocation record updates and deletions. When users with subscriber-level access or above make requests to these endpoints, the plugin fails to verify whether the requesting user has appropriate permissions to modify or delete records that do not belong to them. This lack of input validation and authorization verification creates a direct path for unauthorized data manipulation, as attackers can simply construct malicious requests with arbitrary record IDs to target specific geolocation entries.
From an operational impact perspective, this vulnerability exposes organizations to several security risks including data integrity breaches and potential privacy violations. Attackers could modify geolocation records to misrepresent user locations, potentially affecting location-based services, analytics, or security monitoring systems that rely on accurate geolocation data. The ability to permanently delete geolocation records also creates a risk of data loss and operational disruption, particularly in environments where location tracking is critical for business operations or regulatory compliance requirements. This vulnerability effectively bypasses the standard WordPress user role and capability system, allowing lower-privileged users to perform actions typically restricted to administrators or editors.
The flaw aligns with CWE-284 Access Control Issues, specifically representing improper access control within web applications where authorization checks are missing or insufficient. From an attack framework perspective, this vulnerability maps to multiple ATT&CK techniques including T1078 Valid Accounts for initial access and privilege escalation, as well as T1566 Phishing for initial compromise. The vulnerability can be exploited through various attack vectors including social engineering to obtain subscriber accounts or by leveraging other vulnerabilities that grant access to lower-privileged user accounts within the WordPress environment.
Organizations should immediately upgrade to GEO my WP plugin version 4.5.5.3 or later, which implements proper capability checks and authorization verification for these AJAX endpoints. Security administrators should also implement monitoring of AJAX endpoints for suspicious activity patterns and consider restricting access to these interfaces through additional security layers such as web application firewalls. Regular security audits of WordPress plugins should include verification of access control implementations and capability checks within AJAX handlers. The vulnerability demonstrates the critical importance of implementing defense-in-depth strategies where multiple layers of security controls work together to protect against unauthorized access, particularly in applications that handle sensitive data such as geolocation information.