The Geeky Bot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.2.2. This is due to a nopriv AJAX route allowing a…

The Geeky Bot plugin for WordPress versions up to 1.2.2 contains a critical missing authorization vulnerability. An unauthenticated AJAX route allows attackers to control model/function dispatch and access a plugin installer helper. This enables attackers to download and extract malicious ZIP files into the wp-content/plugins/ directory. The vulnerability allows unauthenticated attackers to install arbitrary plugins and achieve remote code execution on affected WordPress sites.