High severity · published Oct 29, 2026
CVE-2026-114193
WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability
New
7.5
CVSS
–
EPSS
No
On KEV
Description
Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GM
GEO my WordPress · Eyal Fitoussi
through 4.5.5.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114193
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114193
vdb-entry
https://patchstack.com/database/wordpress/plugin/geo-my-wp/vulnerability/wordpress-geo-my-wordpress-plugin-4-5-5-5-broken-access-control-vulnerability?_s_id=cve
More from GEO my WordPress
9.3
CVE-2026-52715
WordPress GEO my WordPress plugin <= 4.5.5 - SQL Injection vulnerability
7.1
CVE-2024-47327
WordPress GEO my WP plugin <= 4.5.0.3 - Reflected Cross Site Scripting (XSS) vulnerability
6.5
CVE-2024-54326
WordPress GEO my WP plugin <= 4.5.0.4 - Broken Access Control vulnerability