The vulnerability is a local file inclusion flaw in the GEO my WP plugin that allows an unauthenticated attacker to include arbitrary .php files and execute code. This leads, and in configurations where PEAR register_argc_argv is enabled, achieving full remote code execution. The weakness corresponds to CWE-98.

The WordPress plugin GEO my WP from vendor ninjew,.5.3, is vulnerable. All installations running these versions are at risk if the gmw_posts_locator_ajax_info_window_loader endpoint is exposed.

The CVSS score is 7.5, indicating a high severity. The EPSS score is below 1%, suggesting very low current exploitation probability, and the issue is not listed in the CISA KEV catalog. The vulnerability can be exploited without authentication by sending an HTTP request to the gmw_posts_locator_ajax_info_window_loader AJAX endpoint. If the server permits PHP file uploads, the attacker can upload a malicious script and trigger the inclusion. In environments where PEAR register_argc_argv is enabled, the inclusion can be leveraged to write and execute arbitrary PHP code, providing full remote code execution.