Vulnerabilities / GEO Plugin by Squirrly SEO / WPSEC-2026-0422
GEO Plugin by Squirrly SEO < 14.2.7 - Authenticated (Editor+) Arbitrary File Read via Favicon Setting
Medium 4.9
CWE-22Fixed in 14.2.7
- ID
- WPSEC-2026-0422
- Plugin
- GEO Plugin by Squirrly SEO (squirrly-seo)
- Affected
- all versions before 14.2.7
- Remediation
- Update to 14.2.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-22
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- GEO Plugin by Squirrly SEO on WPSec AttackSurface
- Fix released
- Published
Description
The GEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary File Read via the favicon setting in all versions up to, and including, 14.2.6. This is due to the favicon being served from a file path stored in the plugin settings without restricting it to the plugin's cache folder. This makes it possible for authenticated attackers able to change the plugin settings, which included Editors through the Rankings and Focus Pages screens, to read the contents of arbitrary files on the server, such as wp-config.php, through the site's favicon URL.
References
- https://wpsec.com/vuln/WPSEC-2026-0422/
- https://plugins.svn.wordpress.org/squirrly-seo/tags/14.2.7/
- https://wordpress.org/plugins/squirrly-seo/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS