GEO my WordPress

Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Untrusted deserialization may create PHP objects; code execution requires a usable gadget chain and its prerequisites, neither of which is established by this record. The structured affected range is n/a through 4.5.5.3.

Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5. The CNA vector indicates that no prior authentication is required. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. The precise affected operation and resulting application-level impact are not described beyond the vulnerability class. The structured affected range is <= 4.5.5.5.

GEO my WP through 4.5.5.3 lets an unauthenticated caller select a PHP file for inclusion through gmw_posts_locator_ajax_info_window_loader. The included file executes, enabling access-control bypass, data disclosure, or code execution when an attacker can place PHP on the server. With PEAR and register_argc_argv enabled, the inclusion can itself be chained to write and execute PHP. The authoritative export does not name the file parameter.

GEO my WP before 4.5.5.3 exposes two authenticated AJAX actions that modify or permanently delete geolocation records without checking ownership or capability. Any Subscriber-or-higher user can supply arbitrary record IDs and alter or delete location data belonging to other users and posts.

GEO my WP is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 4.5.4.

GEO my WordPress is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 4.5.5.

GEO my WP is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 4.5.5.

GEO my WordPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

GEO my WordPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

GEO my WordPress is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

GEO my WordPress is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

GEO my is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.