Aller au contenu
Se connecter
4.3 Moyenne

CVE-2026-15260 The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in…

Description

The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs.

Produits et versions touchés

Produit Versions touchées Corrigé en
GEO my WP 4.5 premières → < 4.5.5.3 4.5.5.3

Autres CVE de GEO my WP

Les 3 CVE de GEO my WP →
CVE-2024-9422 The GEO my WP WordPress plugin before 4.5, gmw-premium-settings WordPress plugin before 3.1 does not sufficiently… 6.6 Moyenne CVE-2024-6330 The GEO my WP WordPress plugin before 4.5.0.2 does not prevent unauthenticated attackers from including arbitrary… 9.8 Critique
Suivre cette CVE