Summary
CVE-2026-66450 is an unauthenticated Local File Inclusion (LFI) vulnerability in the Geo Mashup WordPress plugin, affecting all versions up to and including 1.13.18. The flaw allows remote, unauthenticated attackers to cause the plugin to include arbitrary files on the server, and it has been assigned a CVSS v3.1 base score of 8.1 (High).
Technical details
- Root cause: CWE-98, Improper Control of Filename for Include/Require Statement in a PHP Program, within the Geo Mashup plugin.
- Trigger conditions: No authentication or user interaction is required to trigger the vulnerability.
- Attack vector: Network — the plugin can be reached and exploited remotely over HTTP(S); attack complexity is rated High.
- Impact: Successful exploitation can affect confidentiality, integrity, and availability, potentially exposing sensitive files or leading to further compromise of the WordPress site.
Affected software
- WordPress plugin: Geo Mashup (by Dylan Kuhn), packaged as
geo-mashup - Versions affected: all versions up to and including 1.13.18
- Fixed version: 1.13.19 and later
Severity
- CVSS v3.1 Base Score: 8.1 (High)
- Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Update the Geo Mashup WordPress plugin to version 1.13.19 or later.
- If patching is not immediately possible, consider disabling or removing the Geo Mashup plugin until the update can be applied, and restrict direct network access to the WordPress site where feasible.

