Local File Inclusion Vulnerability in GEO my WP WordPress Plugin

The GEO my WP plugin for WordPress (versions up to and including 4.5.5.3) contains a critical security flaw involving improper input validation within the gmw_posts_locator_ajax_info_window_loader function. This vulnerability enables unauthenticated attackers to perform Local File Inclusion (LFI). By manipulating input parameters, an attacker can force the application to include and execute arbitrary PHP files residing on the web server.

This flaw allows attackers to bypass standard access controls and potentially exfiltrate sensitive application data. Of particular concern is the escalation path in server configurations where the PEAR framework is installed with the register_argc_argv configuration enabled. In these environments, attackers can leverage the LFI vulnerability to inject and execute arbitrary PHP code, resulting in full remote code execution (RCE). Security teams should prioritize patching or disabling the vulnerable component immediately.

Impact

Successful exploitation allows unauthenticated attackers to read sensitive local files, bypass application-level authentication, and achieve full remote code execution on the underlying server if specific PHP environment configurations are present. This impact covers all WordPress instances running GEO my WP version 4.5.5.3 or older.

Recommendation

1. Upgrade the GEO my WP plugin to the latest patched version immediately.
2. Audit server-side PHP configurations, specifically the status of the PEAR library and the register_argc_argv setting, to reduce the risk of RCE escalation.
3. Deploy web application firewall (WAF) rules to detect and block abnormal directory traversal or file inclusion attempts targeting the gmw_posts_locator_ajax_info_window_loader function.
4. Enable and monitor server-side web access logs for anomalous HTTP requests targeting AJAX endpoints with parameter values containing directory navigation sequences (e.g., ../).