What’s Vulnerable › Vulnerabilities

CVE-2024-3591: WordPress Geo Controller < 8.6.5 - PHP Object Injection

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-05-01 · updated 2026-06-17
• Weakness: CWE-502

Description

The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.

Affected products

• creativform Geo Controller: before 8.6.5 — fixed in 8.6.5

How to fix

Upgrade to a fixed version: creativform Geo Controller 8.6.5. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/f85d8b61-eaeb-433c-b857-06ee4db5c7d5/
• https://wpscan.com/vulnerability/f85d8b61-eaeb-433c-b857-06ee4db5c7d5/

Get alerted when CVE-2024-3591 or the next vulnerability affects your stack