The GEO my WP WordPress plugin allows users with subscriber-level access or higher to invoke two logged‑in AJAX actions that update or permanently delete geolocation records, without verifying that the user owns the target record. This insecure direct object reference (IDOR) permits the attacker to change or remove any user's or post's geolocation data, compromising data integrity and potentially exposing sensitive location information.

WordPress sites that use the GEO my WP plugin in a version earlier than 4.5.5.3. Site administrators should verify the plugin version and be aware that all logged‑in users with subscriber or higher capability can trigger the vulnerable AJAX endpoints.

The vulnerability is scored a moderate severity of 4.3 on the CVSS scale, and has an EPSS of less than 1%, indicating a low likelihood of widespread exploitation. Still, an authenticated attacker with subscriber or higher capabilities can send a crafted request to the vulnerable AJAX endpoint, using an arbitrary record ID to update or permanently delete any user or post geolocation data. Because no ownership checks are performed, the attack requires only legitimate credentials, making it relatively easy to execute. Although not listed in the CISA KEV catalog, the potential to tamper with or erase location data poses significant integrity and confidentiality risks for affected sites.