CVE-2026-61992

Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.

Risk score: 74/100
CVSS: 9.8 v3.1
Published: 29 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: GEO my WordPress versions up to 4.5.5.3 have a critical vulnerability to unauthenticated PHP Object Injection, allowing an attacker to potentially gain high privileges, inject code, and achieve arbitrary code execution.
Affected: {'products': ['GEO my WordPress'], 'packages': [], 'versions': ['<= 4.5.5.3']}
Fix: Upgrade to a version greater than 4.5.5.3
Exploitation: No known exploitation

Why it is Amber

CVSS 9.8 critical
Remotely exploitable without logging in
On your watchlist: php

References

https://patchstack.com/database/wordpress/plugin/geo-my-wp/vulnerability/wordpress-geo-my-wordpress-plugin-4-5-5-4-php-object-injection-vulnerability?_s_id=cve

Original description

Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.

Last activity 29 Oct 2026. Patch Forecast updates every hour.