CVE-2026-85200 is a Local File Inclusion vulnerability in the GEO my WP plugin for WordPress, affecting all versions up to and including 4.5.5.3. The flaw exists in the gmw_posts_locator_ajax_info_window_loader function, which improperly controls the filename used in include/require statements. An unauthenticated attacker can exploit this to include arbitrary PHP files, enabling execution of arbitrary PHP code. In environments where PEAR is installed with register_argc_argv enabled, this can escalate to full remote code execution.

Successful exploitation allows unauthenticated attackers to include and execute arbitrary PHP files on the server. This can bypass access controls, expose sensitive data, or lead to remote code execution if the attacker can upload PHP files and the environment supports it. The vulnerability has a CVSS 3.1 base score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix links are provided in the available data. Until a fix is available, restrict file upload capabilities and disable or limit PEAR with register_argc_argv enabled if possible to reduce risk.