External risk intelligence

Unauthenticated PHP Object Injection in GEO my WordPress

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-61992

The vulnerability affects a WordPress plugin, which is typically deployed as part of a public-facing web application. Since web applications are commonly exposed to the internet to serve content or functionality, the vulnerable code is likely reachable via standard public web traffic.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in a WordPress plugin that allows unauthenticated remote code execution. The issue arises from PHP object injection, meaning an attacker could potentially exploit this flaw to take control of affected systems without needing any credentials. Understanding the potential impact on systems running this plugin is key to managing associated risks.

Unauthenticated code execution in a WordPress plugin.
Allows attackers remote control of systems.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability without logging in by sending specially crafted data over the internet to a website using the affected WordPress plugin. The plugin processes this data in a way that allows an attacker to inject malicious PHP objects, potentially leading to a complete compromise of the website.

No authentication required to access.
Triggered by unauthenticated user input.
Leads to full website compromise.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated PHP Object Injection in GEO my WordPress could allow an attacker to execute arbitrary code or manipulate application data when a serialized object is processed. This could impact the integrity and availability of the WordPress site.

Sensitive data could be exposed.
Unauthenticated remote code execution.
Site compromise and data manipulation.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in a widely used WordPress plugin necessitates immediate attention from teams responsible for web applications and their underlying infrastructure. The first practical step is to identify all instances of the affected plugin, confirm their exposure and business criticality, and then assign ownership to initiate a risk-based remediation plan.

Application or Web Platform owners.
Verify plugin presence and exposure.
Plan coordinated remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the GEO my WordPress plugin used for?

GEO my WordPress is a plugin designed to add location-based features to WordPress websites. Users typically install it to create map-based searches, proximity alerts, and directory services that display content based on the user's geographic position or specific locations.

What does PHP object injection mean in CVE-2026-61992?

This vulnerability, classified as CWE-502, occurs when an application takes untrusted, user-provided data and uses it to reconstruct a PHP object without sufficient validation. Because the object can contain malicious instructions, the application unknowingly executes code embedded by the attacker during the reconstruction process.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specially crafted, malicious serialized string to the plugin. Because it does not require a valid user account or administrative session, simply browsing to or interacting with a public-facing part of the site that processes this input is enough. It is not triggered by standard, benign site traffic that does not contain these specific malformed objects.

Is my website at risk if it runs this plugin?

According to Halo Surface Signal, this plugin is typically deployed as part of public-facing web applications. Since these sites are designed to be reachable via standard internet traffic, any instance exposed to the web is likely accessible to an attacker. You should assume the risk is high if your site is connected to the internet.

What steps should I take if I use GEO my WordPress?

Begin by auditing your site inventory to locate all instances where this plugin is currently active. Once identified, evaluate the criticality of the affected websites to prioritize your response. Ensure that site ownership is clearly assigned so that your team can coordinate the necessary updates or mitigation steps to secure the application infrastructure.

References

patchstack.com/database/wordpress/plugin/geo-my-wp/vulnerability/wor…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.