Unauthenticated PHP object injection in GEO my WordPress plugin
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.
Summary
The GEO my WordPress plugin from Von Eyal Fitoussi, versions through 4.5.5.3, has a PHP object injection flaw (CWE-502) where untrusted data is deserialized. An unauthenticated remote attacker can exploit it without logging in, and the impact on confidentiality, integrity and availability is total.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Von Eyal Fitoussi | GEO my WordPress | up to 4.5.5.3 | — | No fix listed | CNA |
- GEO my WordPress VendorVon Eyal Fitoussi Affected up to 4.5.5.3 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for GEO my WordPress.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Timeline
- 2026-10-29 Threatist record created from CVE-2026-61992
- 2026-10-29 Alias added: GHSA-c332-rxr5-p923
- 2026-10-30 CISA SSVC decision points changed
Sources
- CVE-2026-61992 · CVE Program
- CVE-2026-61992 · NVD
- FIRST EPSS
- GHSA-c332-rxr5-p923 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences