PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-52715 Eyal Fitoussi CVE debrief

CVE-2026-52715 is a critical vulnerability in the GEO my WordPress plugin. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated SQL injection. This vulnerability affects GEO my WordPress plugin versions <= 4.5.5.

Vendor
Eyal Fitoussi
Product
GEO my WordPress
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-16
Original CVE updated
2026-06-16
Advisory published
2026-06-16
Advisory updated
2026-06-16

Who should care

Users of GEO my WordPress plugin versions <= 4.5.5 should be aware of this vulnerability and take necessary actions to mitigate it.

Technical summary

CVE-2026-52715 is a critical vulnerability in GEO my WordPress plugin versions <= 4.5.5. It allows unauthenticated SQL injection. The vulnerability has a CVSS score of 9.3 and a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L.

Defensive priority

high

Recommended defensive actions

  • Update GEO my WordPress plugin to a version greater than 4.5.5.
  • Refer to [ref-4](https://patchstack.com/database/wordpress/plugin/geo-my-wp/vulnerability/wordpress-geo-my-wordpress-plugin-4-5-5-sql-injection-vulnerability?_s_id=cve) for mitigation or vendor reference.

Evidence notes

Evidence for this CVE comes from Patchstack.

Official resources

CVE-2026-52715 was published on 2026-06-16T10:16:28.243Z and has not been modified since then.