What is the CVSS score of CVE-2026-15048?

CVE-2026-15048 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Geeky Bot are affected by CVE-2026-15048?

The Geeky Bot WordPress plugin (versions prior to 1.2.8) contains an unauthenticated information disclosure vulnerability enabling attackers to retrieve WordPress usernames, user IDs, and session…. A patch is available.

Is there a public PoC exploit available for CVE-2026-15048?

Yes, a public proof-of-concept exploit is available for CVE-2026-15048. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-15048?

Within 24 hours: Inventory all WordPress instances to identify Geeky Bot plugin installations and determine current versions in use. Within 7 days: Update Geeky Bot plugin to version 1.2.8 or later on all affected WordPress deployments and verify successful updates. Within 30 days: Audit access logs for the past 90 days to detect exploitation attempts via the vulnerable AJAX endpoint (search for requests to `/wp-admin/admin-ajax.php` containing session metadata queries) and document any unauthorized activity.

Geeky Bot CVE-2026-15048

EUVD-2026-51425 HIGH

Information Exposure (CWE-200)

2026-07-31 WPScan

GHSA-gm98-p9q7-cg6p

WordPress Information Disclosure Geeky Bot Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

AJAX endpoint is network-reachable by any unauthenticated client (AV:N, AC:L, PR:N, UI:N); only user data is disclosed with no write or availability impact (C:H, I:N, A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 20:24 vuln.today

CVSS changed

Jul 31, 2026 - 20:22 NVD

7.5 (HIGH)

Patch available

Jul 31, 2026 - 07:01 EUVD

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 31, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and timestamps.

Articles & Coverage 1

News 17 New WordPress Vulnerabilities - 2 Critical, 13 With POC Aug 01, 2026

AnalysisAI

Unauthenticated information disclosure in the Geeky Bot WordPress plugin (all versions before 1.2.8) permits any remote, unauthenticated user to retrieve chat-history session metadata - including WordPress usernames, user IDs, and timestamps - by invoking an unprotected AJAX endpoint. Reported by WPScan with a publicly available proof-of-concept, this flaw provides attackers with a ready-made user enumeration primitive against any publicly reachable WordPress site running the affected plugin. CISA KEV listing is absent and EPSS sits at 0.14% (4th percentile), indicating limited current mass-exploitation, but the POC lowers the barrier for targeted attacks significantly.

Technical ContextAI

The Geeky Bot plugin (CPE: cpe:2.3:a:unknown:geeky_bot:*:*:*:*:*:*:*:*) is a WordPress chatbot integration that stores session interaction data and exposes it via WordPress's AJAX subsystem. WordPress AJAX handlers can be registered for authenticated users (wp_ajax_) or unauthenticated users (wp_ajax_nopriv_); when a handler is registered for the latter without performing an explicit capability or nonce check, any HTTP client can invoke it without credentials via POST to /wp-admin/admin-ajax.php. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) describes this root cause precisely: the code returns sensitive data without verifying the requester's authorization, rather than a memory-safety or injection bug. The disclosed data - WordPress usernames and user IDs - is not publicly surfaced by default WordPress installations, making this a meaningful data exposure rather than a redundant disclosure of already-public information.

RemediationAI

The primary fix is to update the Geeky Bot WordPress plugin to version 1.2.8 or later, which introduces the missing authorization check on the affected AJAX action; this is the vendor-released patch confirmed by the WPScan advisory at https://wpscan.com/vulnerability/881d1548-e6c3-4093-ab8c-dc3a9fcccc34/. If immediate patching is not feasible, the most effective compensating control is to deactivate the Geeky Bot plugin entirely through the WordPress admin panel (Plugins > Deactivate), which removes the exposed AJAX endpoint entirely at the cost of disabling chatbot functionality. A secondary option for operators who cannot deactivate the plugin is to deploy a WAF rule blocking unauthenticated POST requests to /wp-admin/admin-ajax.php bearing the specific action parameter name associated with the chat-history endpoint - the exact action name should be confirmed by reviewing the plugin source prior to deployment to avoid over-blocking. Neither compensating control is a substitute for patching, as both introduce operational trade-offs and do not address the underlying code defect.