EUVD-2026-51425
GHSA-gm98-p9q7-cg6p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AJAX endpoint is network-reachable by any unauthenticated client (AV:N, AC:L, PR:N, UI:N); only user data is disclosed with no write or availability impact (C:H, I:N, A:N).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and timestamps.
Articles & Coverage 1
AnalysisAI
Unauthenticated information disclosure in the Geeky Bot WordPress plugin (all versions before 1.2.8) permits any remote, unauthenticated user to retrieve chat-history session metadata - including WordPress usernames, user IDs, and timestamps - by invoking an unprotected AJAX endpoint. Reported by WPScan with a publicly available proof-of-concept, this flaw provides attackers with a ready-made user enumeration primitive against any publicly reachable WordPress site running the affected plugin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Geeky Bot WordPress plugin version below 1.2.8 is installed and active on the target site, and that the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) is reachable over the network - the default state for any publicly accessible WordPress installation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5 High) accurately reflects the technical ease of exploitation: network-reachable, no complexity, no authentication, no interaction required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker discovers a publicly accessible WordPress site via Google dorking or WordPress plugin enumeration, confirms the Geeky Bot plugin is active by checking plugin-specific asset paths, then sends a crafted unauthenticated HTTP POST request to /wp-admin/admin-ajax.php targeting the unprotected AJAX action using the publicly available WPScan POC. The response returns chat-history session metadata containing WordPress usernames and user IDs, which the attacker feeds into a credential-stuffing tool or uses to craft targeted phishing emails against the site's known user list. |
| Remediation | The primary fix is to update the Geeky Bot WordPress plugin to version 1.2.8 or later, which introduces the missing authorization check on the affected AJAX action; this is the vendor-released patch confirmed by the WPScan advisory at https://wpscan.com/vulnerability/881d1548-e6c3-4093-ab8c-dc3a9fcccc34/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all WordPress instances to identify Geeky Bot plugin installations and determine current versions in use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today