Security readout for executives and security teams
Plain-English summary
Geo Controller versions through 8.9.8 contain a critical flaw that may let an unauthenticated remote attacker submit unsafe serialized PHP data. Successful abuse could compromise website confidentiality, integrity, and availability. The supplied evidence does not establish whether exploitation is occurring or whether every installation is practically exploitable.
Executive priority
Treat this as an urgent internet-facing application risk. Identify affected sites immediately and obtain authoritative remediation guidance. Prioritize externally accessible and business-critical WordPress systems. Do not describe the issue as actively exploited based on the supplied evidence, but maintain heightened monitoring until exposure is removed.
Technical view
CVE-2026-78286 is an unauthenticated PHP object injection vulnerability classified as CWE-502. Its CVSS 3.1 vector is network-accessible, low complexity, requires no privileges or user interaction, and rates confidentiality, integrity, and availability impacts as high. The sources do not describe the vulnerable code path, required gadget chain, or a fixed version.
Likely exposure
WordPress sites running the Geo Controller plugin, package name cf-geoplugin, at version 8.9.8 or earlier are potentially exposed. Prioritize internet-facing installations. The supplied record does not identify affected configurations, prerequisites, or whether vulnerable functionality is enabled by default.
Exploitation context
The CVSS vector indicates remote, unauthenticated attack potential without user interaction. However, the supplied bundle marks KEV false and provides no evidence of active exploitation, public proof-of-concept availability, or observed attacks. Practical impact may depend on available PHP classes or gadget chains, which the sources do not document.
Researcher notes
Available evidence establishes CWE-502 and severe network attack characteristics but omits the affected endpoint, data flow, deserialization sink, gadget requirements, fixed release, and indicators of compromise. Researchers should validate exposure defensively without assuming code execution is guaranteed. The affected-version statement comes from the title and description despite sparse structured version data.
Mitigation direction
- Inventory WordPress sites for Geo Controller versions 8.9.8 and earlier.
- Check current Geo Controller and Patchstack guidance for an explicitly fixed release or mitigation.
- Apply vendor-supported remediation promptly after testing it in a controlled environment.
- If remediation is unavailable, consider disabling the plugin under an approved business continuity plan.
- Increase monitoring of affected sites until remediation is verified.
Validation and detection
- Confirm the installed plugin version from trusted WordPress administration or asset records.
- Verify whether Geo Controller is active on each identified site.
- Confirm remediation guidance directly against the vendor or Patchstack advisory.
- After remediation, rescan assets and verify the vulnerable version is absent or inactive.
- Review web, application, and security logs for unexplained requests or compromise indicators.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-502: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-78286 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9PatchstackVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://patchstack.com/database/wordpress/plugin/cf-geoplugin/vulnerability/wordpress-geo-controller-plugin-8-9-8-php-object-injection-vulnerability?_s_id=cveCVE reference, Patchstack · vdb-entry
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
CWE mapping pending import
This CVE carries a CWE mapping that will resolve to a full Glexia CWE intelligence page after the official CWE import is complete.