GEO my WordPress: Unauthenticated PHP Object Injection

Summary

The WordPress plugin GEO my WordPress up to and including version 4.5.5.3 contains a PHP Object Injection vulnerability (CWE-502) in which untrusted data is deserialized. An unauthenticated remote attacker can exploit it over the network without a login, which may allow manipulation of server-side processing and potentially harmful actions on the web server. Successful exploitation depends on the installed plugins and libraries, which could not be verified.

Affected

• GEO my WordPress plugin up to and including 4.5.5.3
• Patchstack and the CVE record list affected versions as up to 4.5.5.3 (OffSeq lists below 4.5.5.4)

Fixed in

• Version 4.5.5.5 (vendor release notes and WordPress.org changelog)
• Conflict: the Patchstack reference URL points to 4.5.5.4; this could not be confirmed, so 4.5.5.5 is the version to deploy

Workaround

• Unknown. No vendor or Patchstack workaround found.
• Interim option: restrict or disable the plugin until it is updated to 4.5.5.5.

Exploitation

• Not known to be exploited in the wild at time of writing (OffSeq). Not listed in CISA KEV according to a GitHub tracking issue; the CISA KEV catalogue was not checked directly.
• No public proof of concept found; VulDB states no exploit is available.
• Unknown whether a usable gadget chain for remote code execution exists on typical WordPress installations.

Our recommendation

• Inventory all WordPress sites using GEO my WordPress.
• Update the plugin to version 4.5.5.5 immediately.
• Check for signs of compromise, such as unexpected administrator accounts, web shells and changed files.
• Monitor the Patchstack and VulDB entries for public proof of concept or KEV listing.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• Vendor release v4.5.5.5 (GitHub) github.com
• WordPress.org plugin page and changelog wordpress.org
• VulDB entry vuldb.com
• OffSeq threat radar radar.offseq.com
• Strix CVE record www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:02.