What is GHSA-qgxr-8r3m-cw55?

GHSA-qgxr-8r3m-cw55 is a security advisory published by GitHub Security Advisories with Medium severity. The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check...

Which CVE IDs does GHSA-qgxr-8r3m-cw55 cover?

GHSA-qgxr-8r3m-cw55 covers the following CVE IDs: CVE-2026-15260. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qgxr-8r3m-cw55?

GHSA-qgxr-8r3m-cw55 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-qgxr-8r3m-cw55MediumCVSS 4.3

The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check...

Vendor

GitHub Security Advisories

Published

August 3, 2026

Last Modified

August 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-15260 →

📋 Description

The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-15260
https://wpscan.com/vulnerability/6ba28169-0746-44a4-b622-1cd6b9a65608
https://github.com/advisories/GHSA-qgxr-8r3m-cw55