This text was generated using artificial intelligence (AI).CVE-2026-61992 affects the WordPress plugin GEO my WP up to and including version 4.5.5.3. Patchstack rates the vulnerability with a CVSS score of 9.8. A fixed version 4.5.5.5 has been released.
Are my systems affected? Check now →
At a Glance:
| Product / Component | Affected Versions | Patched in |
|---|---|---|
| GEO my WP | <= 4.5.5.3 | 4.5.5.5 |
The vulnerability affects the processing of form settings via import and export functions. According to Patchstack, untrusted data can be deserialized during this process. The error is classified as CWE-502 .
No login is required for the documented attack path. This allows PHP objects to be instantiated via deserialized data. Patchstack assigns CVE-2026-61992 a CVSS score of 9.8.
The plugin is provided through the WordPress.org plugin repository. Therefore, organizations should also include plugin inventories in their vulnerability assessment for WordPress applications.
The manufacturer released GEO my WP 4.5.5.5 in mid-October 2026. The CVE documentation was published at the end of October 2026. According to Patchstack, versions up to and including 4.5.5.3 are affected.
For processing, especially relevant are WordPress installations that use GEO my WP and are accessible from the internet. Since the described attack path does not require a login, these systems should be prioritized during updates.
Recommended steps:
The vulnerability was reported by Ayukiab, coordinated through Patchstack.
Organizations in Germany and Austria operating WordPress instances with personal data should check the 72-hour reporting obligation under Art. 33 GDPR with the relevant data protection authority in the event of a successful exploitation. For NIS-2 obligated entities in Germany and Austria—such as those in the digital infrastructure or public administration sectors—there is also the obligation to report significant security incidents to the respective national authority. Swiss organizations are subject to the revised Information Security Act (ISG) with a reporting obligation to the Federal Office for Cyber Security (BACS).
GEO my WP can be used as a component of a web application under a customer domain. Technical features of WordPress plugins can be identifiable over the internet, for example, through plugin paths or version indications in responses.
LocateRisk can make externally reachable customer assets and deployed software visible and identify and prioritize affected GEO-my-WP installations in its own assets or monitored third parties. The platform does not necessarily determine the specifically vulnerable version. Therefore, the assessment of CVE-2026-61992 still requires checking the actually deployed software version.
For monitored third parties, Vendor Risk Management complements the assignment of web applications and technological dependencies. This supports the documented assessment of responsibilities for affected externally operated applications.
This affects GEO my WP in the versions mentioned above; the vulnerability was fixed in 4.5.5.5. Anyone wanting to know whether GEO my WP is visible in their own externally reachable infrastructure can use the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version that has been installed from the outside—the key factor is comparing it with the manufacturer's advisory.
CVE-2026-61992 refers to a PHP Object Injection vulnerability in the WordPress plugin GEO my WP. It is based on the insecure deserialization of data (CWE-502) in the context of the import and export function for form settings and is rated with a CVSS score of 9.8.
According to Patchstack, versions up to and including 4.5.5.3 are affected. The fixed version 4.5.5.5 was released by the manufacturer in mid-October 2026.
Affected installations should be updated to GEO my WP 4.5.5.5 or higher as soon as possible. Since the attack vector does not require authentication, WordPress instances accessible over the internet with the plugin should be updated particularly urgently.
Status: October 29, 2026. This article is for informational purposes only and is not legal, security, or action advice in individual cases. The security situation and patch availability may have changed since publication; the linked manufacturer advisory is always authoritative. Despite thorough research, we assume no liability for the timeliness, accuracy, and completeness.
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
English 
Deutsch 
Français