CVE-2024-6330: 
WordPress vulnerability analysis and mitigation

The GEO my WP WordPress plugin before version 4.5.0.2 contains a critical security vulnerability identified as CVE-2024-6330. This vulnerability allows unauthenticated attackers to include arbitrary files in PHP's execution context, potentially leading to Remote Code Execution (RCE) and PHAR Deserialization. The vulnerability was discovered by Michael Dyrna and was publicly disclosed on July 29, 2024 (WPScan).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a severe security issue. The vulnerability is classified as CWE-94 and falls under the OWASP Top 10 category A1: Injection. The issue specifically involves the plugin's failure to properly validate file inclusion requests, allowing attackers to execute arbitrary PHP code through specially crafted requests to the wp-admin/admin-ajax.php endpoint (WPScan, NVD).

The vulnerability allows unauthenticated attackers to execute arbitrary code on the affected WordPress installations, potentially leading to complete system compromise. This includes the ability to access, modify, or delete sensitive data, as well as the possibility of using the compromised system as a launching point for further attacks (WPScan).

The vulnerability is highly exploitable as it requires no authentication and can be triggered through specially crafted HTTP requests to the WordPress admin-ajax.php endpoint. Proof of Concept (PoC) code is publicly available, demonstrating both Local File Inclusion (LFI) and Remote Code Execution capabilities (WPScan).

The vulnerability has been patched in version 4.5.0.2 of the GEO my WP plugin. Site administrators are strongly advised to update to this version immediately. No effective workarounds are available other than updating to the patched version (WPScan).