CVE-2026-61992

Summary

The GEO my WordPress plugin before 4.5.5.3 contains an unauthenticated PHP object injection vulnerability (CWE-502) that allows remote attackers to deserialize arbitrary objects via unsanitized user input, potentially leading to remote code execution or data manipulation.

Exploitability

Exploitation is straightforward for remote attackers since no authentication or user interaction is required and the vulnerable endpoint accepts raw serialized PHP data directly from the network.

Blast radius

Successful exploitation could allow full compromise of the WordPress site including unauthorized data access, modification or deletion of database content, and potential server-level code execution depending on available gadget chains.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to GEO my WordPress version 4.5.5.4 or later, as this version includes a patch for the unauthenticated PHP object injection flaw.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.