GEO My WP (<= 4.5.0.1)

The GEO my WP WordPress plugin (versions <= 4.5.0.1) is vulnerable to unauthenticated local file inclusion (LFI) and arbitrary PHP code execution via the 'form[info_window_template][content_path]' parameter. A public exploit PoC has been published.