GeekyBot WordPress Plugin CVE-2026-3456

No special conditions required - remote unauthenticated exploitation against default GeekyBot plugin installations version 1.2.0 and earlier. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms attackers need only network access to the WordPress site with the plugin active. No specific WordPress configuration, feature enablement, or administrative privileges are required. The vulnerable 'attributekey' parameter is exposed in the plugin's standard functionality without requiring non-default settings. Limiting factors: WordPress site must have GeekyBot plugin installed and activated (not present by default in WordPress core). The plugin must be network-accessible, though this is typical for WordPress sites. Exploitation does not require authenticated WordPress sessions, specific user roles, or enabling experimental features. The unchanged scope (S:U) indicates the vulnerability is confined to the WordPress database accessible to the plugin's database user, not enabling container escape or network pivoting.

This vulnerability presents significant real-world risk despite absence from CISA KEV. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates trivial exploitation - remote attackers need no credentials, no special configuration, and no user interaction. The attack complexity is low, meaning no timing windows, race conditions, or advanced techniques are required. WordPress plugins are high-value targets for automated scanners that probe for SQLi across millions of installations. The confidentiality impact is high (C:H), enabling extraction of WordPress credentials, user PII, API keys, and other database secrets, though integrity and availability remain unaffected (I:N/A:N). The fix is available in Trac changeset 3474168, indicating rapid vendor response. Primary risk factors: unauthenticated network attack vector, trivial exploitation, and WordPress's massive attack surface. Mitigating factors: no confirmed POC publication by Wordfence, no KEV listing suggesting exploitation is not yet widespread, and scope unchanged (S:U) limiting lateral movement. Organizations running GeekyBot should prioritize patching, as SQLi vulnerabilities in WordPress plugins are frequently added to attacker toolkits within days of disclosure.

An unauthenticated attacker identifies a WordPress site running GeekyBot plugin version 1.2.0 through automated scanning or manual reconnaissance. They craft an HTTP request to the vulnerable endpoint, injecting a UNION-based SQL payload into the 'attributekey' parameter, such as 'attributekey=1' UNION SELECT user_login,user_pass,user_email FROM wp_users--'. The unsanitized parameter is concatenated directly into the plugin's SQL query, causing the database to return WordPress administrator credentials and email addresses. The attacker extracts password hashes, cracks them offline using rainbow tables or GPU-based attacks, then authenticates as an administrator to install malicious plugins, inject webshells, or pivot to the underlying server. The entire attack chain requires no authentication, no user interaction, and can be automated across thousands of WordPress installations running the vulnerable plugin version.