CVE-2026-15260 is an authorization bypass vulnerability in the GEO my WP WordPress plugin prior to version 4.5.5.3. The plugin fails to verify ownership or user capabilities on two AJAX actions accessible to logged-in users. As a result, users with subscriber-level privileges or above can supply arbitrary record IDs to modify or permanently delete geolocation records belonging to other users or posts. This vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). No CVSS score or official remediation guidance is currently available.

Users with subscriber-level access or higher can abuse this vulnerability to alter or delete geolocation data of other users and posts, potentially compromising data integrity and trustworthiness of location-based features within the affected WordPress sites. There is no indication of remote code execution or privilege escalation beyond the subscriber role, but unauthorized data modification is possible.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user capabilities if possible or disable the affected AJAX actions to prevent exploitation. Monitor for updates from the GEO my WP plugin vendor regarding patches or official mitigations.