GEO my WordPress plugin: Missing authorization allows broken access control
Summary
The WordPress plugin GEO my WordPress (geo-my-wp) in versions up to and including 4.5.5.5 lacks proper authorization checks. According to the CNA, an unauthenticated remote attacker may be able to access functions or data they should not reach, with a high confidentiality impact. Exposure depends on a publicly reachable WordPress site running the affected plugin.
Affected
- GEO my WordPress (geo-my-wp) WordPress plugin, versions up to and including 4.5.5.5
- Note: one source contains conflicting wording ("any version affected"); the affected range is unverified against the Patchstack advisory.
Fixed in
- Update to version 4.5.5.7 or later (per Patchstack CNA solution and OffSeq; 4.5.5.7 to be verified against the Patchstack advisory or vendor changelog).
Workaround
- No vendor workaround known.
- If patching is delayed, disable the plugin where its map features are not business-critical, or restrict access to the affected functions via web server or WAF rules. No specific endpoint is confirmed.
Exploitation
- Not known to be exploited in the wild; CISA KEV: No.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- VulDB reports no public exploit available.
- Patchstack states the vulnerability is expected to become exploited.
Our recommendation
- Identify all WordPress sites running geo-my-wp version 4.5.5.5 or earlier.
- Update the plugin to 4.5.5.7 or later as soon as possible and confirm the version.
- Until patched, disable the plugin where possible or apply WAF rules.
- Review web server and WordPress logs for unexpected requests to GEO my WP endpoints and for unexpected accounts or data changes.
- Monitor the Patchstack entry and NVD, as NVD analysis is still pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- OffSeq threat radar (CVE-2026-114193) radar.offseq.com
- VulDB entry 428351 vuldb.com
- CVE record mirror (threatint) cve.threatint.com
- WPScan plugin overview geo-my-wp wpscan.com
- GitHub issue astruzocyber/CVE 3483 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 11:28.
Original description (NVD)
Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.