Cpe:2.3:a:geomywp:geo_my_wp:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ageomywpgeo_my_wpwordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 12 Sep 2026 09:19:15 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLocal File Inclusion Vulnerability in GEO my WP WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-09-geo-my-wp-lfi/Sat, 12 Sep 2026 09:19:15 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-geo-my-wp-lfi/The GEO my WP plugin for WordPress is vulnerable to unauthenticated local file inclusion (LFI) via the gmw_posts_locator_ajax_info_window_loader function, which can be escalated to remote code execution in specific PEAR-enabled environments.The GEO my WP plugin for WordPress (versions up to and including 4.5.5.3) contains a critical security flaw involving improper input validation within the gmw_posts_locator_ajax_info_window_loader function. This vulnerability enables unauthenticated attackers to perform Local File Inclusion (LFI). By manipulating input parameters, an attacker can force the application to include and execute arbitrary PHP files residing on the web server.

This flaw allows attackers to bypass standard access controls and potentially exfiltrate sensitive application data. Of particular concern is the escalation path in server configurations where the PEAR framework is installed with the register_argc_argv configuration enabled. In these environments, attackers can leverage the LFI vulnerability to inject and execute arbitrary PHP code, resulting in full remote code execution (RCE). Security teams should prioritize patching or disabling the vulnerable component immediately.

Impact

Successful exploitation allows unauthenticated attackers to read sensitive local files, bypass application-level authentication, and achieve full remote code execution on the underlying server if specific PHP environment configurations are present. This impact covers all WordPress instances running GEO my WP version 4.5.5.3 or older.

Recommendation

  1. Upgrade the GEO my WP plugin to the latest patched version immediately.
  2. Audit server-side PHP configurations, specifically the status of the PEAR library and the register_argc_argv setting, to reduce the risk of RCE escalation.
  3. Deploy web application firewall (WAF) rules to detect and block abnormal directory traversal or file inclusion attempts targeting the gmw_posts_locator_ajax_info_window_loader function.
  4. Enable and monitor server-side web access logs for anomalous HTTP requests targeting AJAX endpoints with parameter values containing directory navigation sequences (e.g., ../).
]]>highadvisorywordpresslfivulnerabilityrce