WP-GeoMeta Privilege Escalation Vulnerability in WordPress

A privilege escalation vulnerability has been identified in the WP-GeoMeta plugin for WordPress, specifically in versions 0.3.4 to 0.3.5. The issue arises from a missing capability check in the wp_ajax_wpgm_start_geojson_import() function, allowing authenticated attackers with Subscriber-level access and above to elevate their privileges to that of an administrator.

Impact

Exploitation of this vulnerability allows authenticated users to gain administrative privileges, potentially leading to unauthorized changes or access within the WordPress site.