The GEO my WordPress plugin (versions up to 4.5.0.4) contains a missing authorization vulnerability (CVE-2024-54326) due to incorrectly configured access control security levels. This flaw allows an attacker with some privileges to exploit insufficient authorization checks, potentially gaining unauthorized access to sensitive data or functionality. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting a medium severity with network attack vector and no user interaction required. No official patch or vendor advisory is currently provided, and no known exploits have been reported.

The vulnerability can lead to unauthorized access to certain features or data within the GEO my WordPress plugin, potentially exposing sensitive information. The impact is limited to confidentiality as indicated by the CVSS vector (C:H/I:N/A:N). There is no indication of integrity or availability impact. Exploitation requires some level of privileges, reducing the risk compared to unauthenticated attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is released, users should restrict plugin access to trusted users only and review access control configurations to minimize exposure. Monitor official vendor channels for updates and apply any official fixes promptly once available.