CVE-2026-61992

Name of the Vulnerable Software and Affected Versions GEO my WordPress versions 4.5.5.3 and earlier

Description An unauthenticated PHP object injection exists in the geolocation plugin. This issue allows attackers to inject malicious objects into the site, which could potentially lead to remote code execution. PHP Object Injection occurs when untrusted input is passed to the PHP unserialize() function, allowing an attacker to manipulate the object's properties and trigger unintended code paths.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.