GEO my WP: Unauthenticated Local File Inclusion (CVE-2024-6330)
The GEO my WP WordPress plugin (versions <= 4.5.0.1) is vulnerable to unauthenticated local file inclusion (LFI) and arbitrary PHP code execution via the 'form[info_window_template][content_path]' parameter. A public exploit PoC has been published.
CVE search metadata
CVE search record: CVE-2024-6330. Severity: critical. CVSS: 9.8. EPSS: 2.14%. KEV: no. Product: GEO my WP (<= 4.5.0.1). Brief: GEO my WP: Unauthenticated Local File Inclusion (CVE-2024-6330). Brief link: https://feed.craftedsignal.io/briefs/2026-10-geo-my-wp-lfi/
Triage facts
Revision 1- Applicability
- GEO my WP (<= 4.5.0.1)
- Evidence
- Confirmed activeHigh confidence
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 25, 00:37 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C2Likely