CVE-2024-9422: Geomywp Geo My WordPress

Medium severity, CVSS 6.6. EPSS: 0.8% chance of exploitation in the next 30 days.

The GEO my WP WordPress plugin before 4.5, gmw-premium-settings WordPress plugin before 3.1 does not sufficiently validate files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server.

Affected products

• Geomywp Geo My WordPress: before 4.5 (fixed in 4.5)
• Geomywp Geo My WordPress Premium Settings: before 3.1 (fixed in 3.1)

Published 2024-11-22. Last modified 2026-06-17.