Description

The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmw_posts_locator_ajax_info_window_loader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. In environments where PEAR is installed with register_argc_argv enabled, this file inclusion can be leveraged to write and execute arbitrary PHP code, achieving full remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-12T08:16:24.810Z",
  "pubdate": "2026-09-12T08:16:24.810Z",
  "executiveSummary": "The GEO my WP WordPress plugin, in versions up to and including 4.5.5.3, contains a critical Local File Inclusion (LFI) vulnerability residing within the gmw_posts_locator_ajax_info_window_loader function.\nThis security flaw allows unauthenticated remote attackers to manipulate input parameters to include and execute arbitrary PHP files present on the web server's filesystem.\nSuccessful exploitation bypasses existing access control mechanisms and exposes sensitive information, such as configuration files and database credentials.\nIn specific server configurations, particularly those where PEAR is installed with the register_argc_argv directive enabled, this vulnerability can be escalated to achieve full Remote Code Execution (RCE).\nThe vulnerability poses a severe risk to the confidentiality, integrity, and availability of the affected WordPress installation, as it grants attackers the ability to execute arbitrary PHP code within the server's execution context.\nNo authentication is required to initiate an attack, increasing the overall risk profile as it is accessible to any remote, unauthenticated user.",
  "technicalDetails": "The vulnerability originates from the gmw_posts_locator_ajax_info_window_loader function within the GEO my WP plugin. The root cause is the improper sanitization and validation of user-supplied input that is subsequently passed into file inclusion primitives, such as include() or require().\nAn unauthenticated attacker can supply a malicious path to the vulnerable parameter handled by the gmw_posts_locator_ajax_info_window_loader function. By providing a path to a PHP file located on the local server, the PHP interpreter includes the specified file and executes its contents within the application's runtime environment.\nThe attack flow involves the following stages: First, the attacker identifies the entry point in the gmw_posts_locator_ajax_info_window_loader function. Second, the attacker crafts a malicious request containing a directory traversal or direct file path string to target a specific PHP script. Third, the plugin processes this unsanitized input and executes the target file. If an attacker has previously uploaded a PHP-based web shell to the server via secondary vectors (e.g., media upload vulnerabilities), they can point the LFI vector to that file to gain persistent code execution.\nThe impact of this vulnerability is significant. Beyond mere file disclosure, if PEAR is installed and register_argc_argv is enabled, the environment may allow for sophisticated exploitation techniques that facilitate arbitrary PHP code execution, effectively leading to a total system compromise.\nAffected versions include all iterations of GEO my WP up to and including 4.5.5.3. The vulnerability is network-exposed and requires zero authentication, making it a high-priority target for automated scanning and exploitation tools. Post-exploitation, an attacker can leverage the execution context to perform lateral movement, exfiltrate the WordPress database, modify application configuration files, or deploy further malicious payloads such as backdoors, ransomware, or cryptominers."
}