CVE-2026-85200 in GEO my WP Plugin
Summary
by MITRE • 09/12/2026
The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmw_posts_locator_ajax_info_window_loader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. In environments where PEAR is installed with register_argc_argv enabled, this file inclusion can be leveraged to write and execute arbitrary PHP code, achieving full remote code execution.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/12/2026
The GEO my WP plugin for WordPress contains a critical Local File Inclusion vulnerability affecting all versions up to 4.5.5.3. This flaw resides within the gmw_posts_locator_ajax_info_window_loader function, which processes user-supplied input without adequate sanitization or validation before using it in file inclusion operations. The nature of this vulnerability allows unauthenticated attackers to manipulate the request parameters to point towards arbitrary files on the server's filesystem. By exploiting this weakness, an attacker can cause the PHP interpreter to include and execute code from any accessible .php file, effectively bypassing standard access controls that would normally restrict such actions.
The operational impact of this Local File Inclusion is severe because it directly facilitates Remote Code Execution under specific conditions. While simple inclusion might allow for information disclosure or sensitive data theft by reading configuration files, the true danger emerges when combined with other server configurations. Specifically, in environments where PEAR is installed and the register_argc_argv PHP directive is enabled, attackers can leverage this vulnerability to write arbitrary content to a file on the disk and subsequently execute it. This chain of exploitation transforms a simple inclusion flaw into a full remote code execution vector, granting the attacker complete control over the compromised server environment.
From a classification perspective, this vulnerability aligns with CWE-98 Improper Control of Filename for Include/Require in PHP Program, as the application fails to properly validate filenames before including them. Furthermore, the exploitation technique maps directly to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, particularly those involving server-side script execution through file inclusion mechanisms such as T1059 or specific web attack vectors like T1190 Exploit Public-Facing Application. The ability to write files via PEAR manipulation also touches upon persistence mechanisms where attackers maintain access by planting backdoors on the system.
Mitigation strategies must prioritize immediate patching of the GEO my WP plugin to version 4.5.5.4 or later, which addresses this input validation deficiency. Administrators should ensure that all WordPress plugins are kept up to date and configured with security best practices in mind. Additionally, server-level hardening is recommended by disabling unnecessary PHP extensions like PEAR if they are not strictly required for application functionality. Disabling the register_argc_argv directive can also mitigate the specific exploitation path involving file writing via PEAR, although patching the plugin remains the primary and most effective defense against this vulnerability.