CVE-2026-15260: GEO my WP Privilege Escalation Flaw

CVE-2026-15260 Overview

CVE-2026-15260 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in the GEO my WP WordPress plugin versions before 4.5.5.3. The plugin exposes two logged-in AJAX actions without performing ownership or capability checks. Any authenticated user with subscriber-level access or above can modify or permanently delete geolocation records belonging to other users and posts by supplying arbitrary record IDs.

Critical Impact
Authenticated attackers with minimal privileges can tamper with or destroy geolocation data across the site, disrupting location-dependent features and content integrity.

Affected Products

GEO my WP WordPress plugin versions prior to 4.5.5.3

Discovery Timeline

2026-08-03 - CVE-2026-15260 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-15260

Vulnerability Analysis

The GEO my WP plugin registers two AJAX endpoints available to authenticated users. These handlers accept a record identifier from the request and operate on the corresponding geolocation record without verifying that the requesting user owns the record or holds the appropriate capability. As a result, a subscriber-level account can pass arbitrary record IDs to modify or delete geolocation entries associated with other users or posts.

The issue falls under Authorization Bypass through User-Controlled Key [CWE-639]. Successful exploitation impacts data integrity by allowing unauthorized modification and destruction of geolocation records. Confidentiality is not affected, and availability of the WordPress site itself remains intact, though location-driven features may fail once records are removed.

Root Cause

The root cause is missing authorization logic on two logged-in AJAX actions. The handlers do not call current_user_can() for the relevant capability, nor do they compare the record's owning user or post against the current session. Trust is placed entirely on the supplied record ID.

Attack Vector

Exploitation requires a valid authenticated session at subscriber level or higher, which is trivial to obtain on sites that permit open registration. The attacker sends crafted admin-ajax.php POST requests referencing arbitrary geolocation record IDs. See the WPScan Vulnerability Report for technical details on the affected AJAX actions.

Detection Methods for CVE-2026-15260

Indicators of Compromise

Unexpected deletion or modification of geolocation records tied to posts or users that the acting account does not own.
Repeated POST requests to wp-admin/admin-ajax.php from subscriber-level accounts targeting GEO my WP action names with incrementing or enumerated record ID parameters.
Newly registered subscriber accounts issuing AJAX traffic shortly after account creation.

Detection Strategies

Review web server access logs for authenticated admin-ajax.php requests referencing GEO my WP action names, correlating the requester's user ID with the owning user of the referenced record.
Monitor the plugin's database tables for deletion or update events originating from non-privileged user sessions.
Alert on high-volume AJAX activity from low-privilege accounts, which suggests record ID enumeration.

Monitoring Recommendations

Enable WordPress audit logging to capture AJAX action invocations, actor identity, and target record IDs.
Forward WordPress and web server logs to a centralized analytics platform for correlation across accounts and endpoints.
Track subscriber account creation rates and flag anomalies that coincide with AJAX traffic spikes.

How to Mitigate CVE-2026-15260

Immediate Actions Required

Update GEO my WP to version 4.5.5.3 or later on all affected WordPress sites.
Audit existing geolocation records and restore any unauthorized modifications from backup.
Review recently registered subscriber accounts and remove any that appear illegitimate.

Patch Information

The vendor addressed CVE-2026-15260 in GEO my WP version 4.5.5.3. The fix introduces ownership and capability checks on the affected AJAX handlers. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable open user registration or restrict the subscriber role until the plugin is upgraded.
Temporarily deactivate the GEO my WP plugin if location features are non-essential.
Apply a Web Application Firewall (WAF) rule to block unauthenticated and low-privilege access to the vulnerable AJAX actions.

bash

# Update GEO my WP via WP-CLI
wp plugin update geo-my-wp --version=4.5.5.3

# Verify the installed version
wp plugin get geo-my-wp --field=version