Critical vulnerability in GEO my WordPress plugin

WordPress

What happened

A critical vulnerability has been discovered that allows unauthenticated PHP object injection in GEO my WordPress versions up to 4.5.5.3.

Are you affected?

The GEO my WordPress plugin versions 4.5.5.3 and below may be affected.

What to do now

1. Upgrade to a patched version as soon as possible.
2. Review your system for any signs of compromise.
3. Check the official advisory for more information.

Sources

• cve.now/CVE-2026-61992
• cve.now/GHSA-c332-rxr5-p923
• CVE-2026-61992
• GHSA-c332-rxr5-p923
• https://nvd.nist.gov/vuln/detail/CVE-2026-61992
• https://patchstack.com/database/wordpress/plugin/geo-my-wp/vulnerability/wordpress-geo-my-wordpress-plugin-4-5-5-4-php-object-injection-vulnerability?_s_id=cve
• cve.now/GHSA-C332-RXR5-P923
• GHSA-C332-RXR5-P923

Data sources: cve.now, CISA KEV, GitHub Advisory Database, OSV.

This product uses data from the NVD API but is not endorsed or certified by the NVD.