WordPress Geo Controller < 8.6.5 - PHP Object Injection
Priority HIGH 68CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-502.
Summary
The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00489 42nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Geo Controller (Unknown): 8.6.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Geo Controller | before 8.6.5 | 8.6.5 | Patch available | CNA |
- Geo Controller VendorUnknown Affected before 8.6.5 Fixed in 8.6.5 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:infinitumform:geo_controller:*:*:*:*:*:wordpress:*:* | before 8.6.5 | Vulnerable | INFINITUM FORM |
- cpe:2.3:a:infinitumform:geo_controller:*:*:*:*:*:wordpress:*:* Versions before 8.6.5 Vulnerable ·INFINITUM FORM
Remediation
- Fix · CNA Geo Controller (Unknown) Fixed in 8.6.5
Timeline
- 2026-10-02 Threatist record created from CVE-2024-3591
- 2026-10-03 Alias added: GHSA-j9wj-h588-6g73
References
More INFINITUM FORM Geo Controller vulnerabilities
- TI-2024-06841 Geo Controller <= 8.6.9 - Missing Authorization to Unauthenticated Shortcode Execution CVSS 3.1MEDIUM 5.3
- TI-2024-06840 Geo Controller <= 8.7.3 - Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletion CVSS 3.1MEDIUM 4.3
Sources
- CVE-2024-3591 · CVE Program
- CVE-2024-3591 · NVD
- FIRST EPSS
- GHSA-j9wj-h588-6g73 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences