CVE-2026-85200: GEO my WP Plugin RCE Vulnerability

CVE-2026-85200 Overview

The GEO my WP plugin for WordPress contains a Local File Inclusion (LFI) vulnerability affecting all versions up to and including 4.5.5.3. The flaw resides in the gmw_posts_locator_ajax_info_window_loader function, which fails to validate template paths supplied through AJAX requests. Unauthenticated attackers can include and execute arbitrary .php files present on the server. In environments where PEAR is installed with register_argc_argv enabled, the file inclusion can be escalated to write and execute attacker-controlled PHP code, achieving full remote code execution. The vulnerability is tracked as CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program.

Critical Impact
Unauthenticated attackers can bypass access controls, disclose sensitive data, and in specific server configurations achieve remote code execution against WordPress sites running the vulnerable plugin.

Affected Products

GEO my WP plugin for WordPress — all versions up to and including 4.5.5.3
Posts Locator addon shipped within GEO my WP (vulnerable gmw-posts-locator-functions.php code path)
Fixed in GEO my WP 4.5.5.4

Discovery Timeline

2026-09-12 - CVE-2026-85200 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-85200

Vulnerability Analysis

The vulnerability is a Local File Inclusion flaw exposed through an AJAX endpoint that renders info-window templates for the Posts Locator component. The gmw_posts_locator_ajax_info_window_loader function accepts a template path from untrusted request data and passes it to a PHP include-style operation without validating that the resolved path is confined to the plugin directory or that the file extension is expected.

Because the endpoint is reachable without authentication, any remote actor can request inclusion of arbitrary .php files residing on the server. The direct consequence is execution of whatever PHP code exists in the included file. Attackers commonly abuse this to load bundled library files that accept command-line style arguments, at which point secondary primitives determine whether the outcome is information disclosure or full code execution.

When PHP is configured with register_argc_argv enabled and the PEAR package is installed, the well-known Archive_Tar and related PEAR classes can be included through this LFI to stage and execute attacker-supplied PHP, converting the file inclusion into unauthenticated remote code execution.

Root Cause

The root cause is insufficient validation of a filesystem path derived from HTTP input before it is passed to a PHP include operation. The patched code introduces a new gmw_validate_ajax_info_window_template_path helper that resolves the supplied path with realpath(), verifies the file exists and is readable, confirms the extension is php, and requires the resolved path to reside within the calling component's registered plugin directory.

Attack Vector

Exploitation occurs over the network against the WordPress admin-ajax.php endpoint that dispatches the vulnerable info-window loader action. No credentials or user interaction are required. The attacker supplies a crafted template path parameter pointing at any readable .php file on the underlying host.

php

/**
 * Security patch introduced in GEO my WP 4.5.5.4
 * Source: https://github.com/Fitoussi/geo-my-wp/commit/5a768bf1c6e44ded83a65be8789f3587515665ac
 *
 * Validate an AJAX info-window template path.
 *
 * @since 4.5.5.4
 *
 * @param string $template_path Info-window template path.
 * @param array  $gmw           GEO my WP form.
 *
 * @return string|false Canonical template path on success, false otherwise.
 */
function gmw_validate_ajax_info_window_template_path( $template_path, $gmw ) {

    if ( ! is_string( $template_path ) || empty( $gmw['component'] ) ) {
        return false;
    }

    $file_path = realpath( $template_path );

    if ( false === $file_path
        || ! is_file( $file_path )
        || ! is_readable( $file_path )
        || 'php' !== strtolower( pathinfo( $file_path, PATHINFO_EXTENSION ) ) ) {
        return false;
    }

    $component_data = gmw_get_addon_data( $gmw['component'] );

    if ( empty( $component_data['plugin_dir'] ) ) {
        return false;
    }
}

The patch enforces canonical path resolution, extension allow-listing, and plugin-directory containment before any template is included.

Detection Methods for CVE-2026-85200

Indicators of Compromise

Unauthenticated POST or GET requests to admin-ajax.php invoking the GEO my WP info-window loader action with a template_path parameter that contains ../, absolute filesystem paths, or references to PEAR files such as Archive/Tar.php.
Web server access logs showing repeated requests to the Posts Locator AJAX action from a single external IP within a short window.
Unexpected creation or modification of .php files under the WordPress uploads/ directory or web root shortly after suspicious AJAX activity.
Outbound network connections initiated by the PHP worker process to attacker-controlled hosts following requests to the vulnerable endpoint.

Detection Strategies

Inspect HTTP request bodies to admin-ajax.php for action values tied to GEO my WP info-window handling combined with path-like or traversal patterns in the template parameter.
Alert on any GEO my WP AJAX request whose parameters resolve to a file outside wp-content/plugins/geo-my-wp/.
Correlate LFI request patterns with subsequent process creation events on the web server host, especially PHP spawning shell interpreters.

Monitoring Recommendations

Enable verbose access logging on the web server and forward logs to a centralized analytics platform for query and retention.
Monitor the WordPress wp-content/plugins/geo-my-wp directory for the installed plugin version and flag any host still reporting 4.5.5.3 or earlier.
Track PHP error and warning logs for include()/require() failures referencing unexpected paths, which often precede successful exploitation attempts.

How to Mitigate CVE-2026-85200

Immediate Actions Required

Upgrade the GEO my WP plugin to version 4.5.5.4 or later on every WordPress site where it is installed.
If an immediate upgrade is not possible, deactivate and remove the plugin until the patched version can be deployed.
Audit web server and application logs for prior exploitation attempts against the Posts Locator AJAX action and investigate any hosts that show suspicious template path parameters.

Patch Information

The vendor released GEO my WP 4.5.5.4, which adds the gmw_validate_ajax_info_window_template_path function to enforce realpath() resolution, .php extension checking, and containment within the calling component's plugin directory. Review the fix in the GitHub commit 5a768bf and the Wordfence vulnerability analysis for additional context.

Workarounds

Disable the GEO my WP Posts Locator addon if the plugin cannot be upgraded immediately.
Set register_argc_argv = Off in php.ini and remove or restrict PEAR from production web servers to eliminate the known LFI-to-RCE escalation path.
Block or rate-limit unauthenticated requests to admin-ajax.php actions used by GEO my WP at the web application firewall, and drop requests whose parameters contain path traversal sequences or absolute filesystem paths.

bash

# Example php.ini hardening to reduce LFI-to-RCE risk
register_argc_argv = Off
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"