vulnerability

WordPress Plugin: cf-geoplugin: CVE-2024-7381: Missing Authorization

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:P/I:N/A:N)

Published

Sep 4, 2024

Added

May 15, 2025

Modified

Apr 29, 2026

Description

The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks on the ajax__shortcode_cache function in all versions up to, and including, 8.6.9. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes available on the target site.

Solution

cf-geoplugin-plugin-cve-2024-7381

References

https://www.cve.org/CVERecord?id=CVE-2024-7381
https://www.wordfence.com/threat-intel/vulnerabilities/id/4ed7b13a-eec3-4035-8815-15228fb05af1?source=api-prod
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-48317
CVE-2024-7381
https://attackerkb.com/topics/CVE-2024-7381
CWE-862
EUVD-EUVD-2024-48317

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report