The CVSS-to-EPSS gap in this Geo Mashup LFI is worth sitting with before panicking. An 8.1 score sounds alarming, but the 0.00348 EPSS probability tells you this isn't likely to see mass exploitation — at least not yet, and not without chaining.
The "unauthenticated" label is technically accurate but can mislead. LFI payloads depend heavily on what the target server exposes and what the plugin actually passes to include(). You need a predictable file path, and default PHP configurations (allow_url_include off, specific wrappers disabled) may neutralize the vector on many deployments. The real severity hinges on what an attacker can actually read — on a standard WordPress install, wp-config.php is the obvious target, but Geo Mashup's specific attack surface includes cached map tiles, geospatial query results, and custom configuration data stored in writable directories.
The WordPress plugin ecosystem creates a compressed exploitation timeline: patches roll out fast, but so do weaponization tools once a reliable POC drops. The low EPSS might not last if someone publishes a blog post with "WordPress Geo Mashup LFI — 3-step reproduction."
What separates this from a typical plugin LFI is the data category. Geo Mashup stores location intelligence — movement patterns, behavioral geography, operational data. Mass-exploitation scanners will ignore this. A targeted adversary — nation-state, organized crime, a specific competitor investigating your organization — won't care about EPSS probability. They care whether this plugin exposes geospatial intelligence on a high-value installation. The blast radius isn't "arbitrary file read on a random WordPress install" — it's "geospatial intelligence on whatever population this deployment tracks."
For defenders: check whether Geo Mashup is actually needed. If the project evolved and the plugin became forgotten but remains active, that's exactly the condition attackers scan for. Remove unused plugins rather than just deactivating them. Verify PHP's allow_url_include is disabled, restrict what the web server user can read, and monitor your WordPress endpoint for anomalous filesystem access patterns.