SZB-9e49eaeab5
EUVD lists unauthenticated PHP object injection in GEO my WordPress
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Eyal Fitoussi
- Product
- GEO my WordPress
- First seen
Summary
The EU Vulnerability Database (EUVD) entry EUVD-2026-112959, relayed in a Mastodon post, describes an unauthenticated PHP object injection in GEO my WordPress versions 4.5.5.3 and earlier. The entry gives a CVSS v3.1 score of 9.8 and was published 2026-10-29 and updated 2026-10-30.
If you use Eyal Fitoussi
Update GEO my WordPress to a version later than 4.5.5.3.
Check the plugin's changelog or vendor page for the fixed version.
If no fix is available, deactivate the plugin.
What the sources say 1
· Mastodon: “Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.” Source