PT-2024-39622 · WordPress · Geo My Wp+1

Michael Dyrna · Published 2024-11-21 · Updated 2025-06-09 · CVE-2024-9422

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GEO my WP WordPress plugin versions prior to 4.5 gmw-premium-settings WordPress plugin versions prior to 3.1

Description The issue is related to insufficient validation of files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server. This could potentially lead to remote attacks.

Recommendations For GEO my WP WordPress plugin versions prior to 4.5, update to version 4.5 or later. For gmw-premium-settings WordPress plugin versions prior to 3.1, update to version 3.1 or later. As a temporary workaround, consider restricting file uploads to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2024-9422

Affected Products

Geo My Wp

Gmw-Premium-Settings

References · 8

• 🔥 https://wpscan.com/vulnerability/81320923-767c-43f0-a8eb-b398c306c16f · Exploit
• https://osv.dev/vulnerability/CVE-2024-9422 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9422 · Security Note
• https://t.me/cvenotify/125109 · Telegram Post
• https://twitter.com/CVEnew/status/1859845035962876082 · Twitter Post
• https://t.me/cvenotify/122342 · Telegram Post
• https://t.me/cvenotify/102355 · Telegram Post
• https://twitter.com/oktsec/status/1859863809684390046 · Twitter Post