CVE-2026-5294-nvd.nist.gov-Deferred

The Geeky Bot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.2.2. This is due to a nopriv AJAX route allowing a…

Published:

4 May 2026 at 22:00:00

Alert date:

5 May 2026 at 20:13:49

Source:

nvd.nist.gov

Web Technologies

The Geeky Bot plugin for WordPress versions up to 1.2.2 contains a critical missing authorization vulnerability. An unauthenticated AJAX route allows attackers to control model/function dispatch and access a plugin installer helper. This enables attackers to download and extract malicious ZIP files into the wp-content/plugins/ directory. The vulnerability allows unauthenticated attackers to install arbitrary plugins and achieve remote code execution on affected WordPress sites.

Technical details

Mitigation steps:

Affected products:

Geeky Bot WordPress Plugin