CVE-2025-4103: Luminfire Wp-Geometa

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

The WP-GeoMeta plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wp_ajax_wpgm_start_geojson_import() function in versions 0.3.4 to 0.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.

Affected products

• Luminfire Wp-Geometa: from 0.3.4, up to and including 0.3.5

Published 2025-05-31. Last modified 2026-06-17.