WordPress Plugin Vulnerabilities

GEO my WordPress < 4.5.1 - Missing Authorization via get_field_options_ajax

Description

The GEO my WordPress plugin for WordPress is vulnerable to unauthorized access to data due to a missing capability check on the get_field_options_ajax function in versions up to, and including, 4.5.0.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to obtain plugin settings.

Affects Plugins

Plugin icon
geo-my-wp
Fixed in 4.5.1

References

CVE
CVE-2024-54326
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/8f7626b3-86b5-4aa2-871b-07f84a43c47f

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Trương Hữu Phúc (truonghuuphuc)
Verified
No
WPVDB ID
aa2d2335-357a-4449-b6cc-661c9067dc2c

Timeline

Publicly Published
2024-12-11 (about 1 year ago)
Added
2024-12-19 (about 1 year ago)
Last Updated
2024-12-19 (about 1 year ago)

Other

Published
Title
Published
2026-08-24
Title
My Agile Privacy® < 3.3.7 - Missing Authorization to Unauthenticated Plugin Settings Modification via map_missing_cookie_shield / map_check_consent_mode_status AJAX Actions
Published
2024-06-06
Title
LA-Studio Element Kit for Elementor < 1.3.7.4 - Missing Authorization
Published
2024-01-16
Title
Import and export users and customers < 1.24.7 - Missing Authorization via fire_cron REST endpoint
Published
2024-04-02
Title
ShortPixel Adaptive Images < 3.8.3 - Missing Authorization in activate_ai_handler and deactivate_ai_handler
Published
2026-10-01
Title
Site Reviews < 8.3.3 - Missing Authorization