WordPress Plugin Vulnerabilities

Geo My WP < 4.5.5.3 - Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR

Description

The plugin does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs.

Proof of Concept

Affects Plugins

Plugin icon
geo-my-wp
Fixed in 4.5.5.3

References

CVE
CVE-2026-15260

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Yaswanth Reddy Sunkara
Submitter
Yaswanth Reddy Sunkara
Verified
Yes
WPVDB ID
6ba28169-0746-44a4-b622-1cd6b9a65608

Timeline

Publicly Published
2026-07-24 (about 10 days ago)
Added
2026-07-24 (about 9 days ago)
Last Updated
2026-07-24 (about 9 days ago)

Other

Published
Title
Published
2025-10-14
Title
Quick Featured Images < 13.7.3 - Insecure Direct Object Reference to Image Manipulation
Published
2022-09-19
Title
Booster for WooCommerce - Subscriber+ Order Status Update
Published
2025-05-13
Title
PeepSo Core: File Uploads < 6.4.6.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via file_download
Published
2025-05-05
Title
User Registration & Membership – Custom Registration Form, Login Form, and User Profile < 4.2.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion
Published
2023-02-14
Title
Popup Builder by OptinMonster < 2.12.2 - Subscriber+ Arbitrary Post Content Disclosure