What is the CVSS score of CVE-2026-3456?

CVE-2026-3456 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of GeekyBot WordPress Plugin are affected by CVE-2026-3456?

GeekyBot WordPress plugin versions through 1.2.0 contain an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive database contents without credentials or user…

How to fix or mitigate CVE-2026-3456?

Within 24 hours: audit all WordPress installations for GeekyBot plugin presence and version; disable or remove the plugin immediately if identified. Within 7 days: contact Wordfence and monitor changeset 3474168 for patch release timeline; prepare patch deployment process. Within 30 days: once vendor patch is released, apply to all instances; restore from clean backups if compromise is suspected; conduct database audit for unauthorized access.

GeekyBot WordPress Plugin CVE-2026-3456

EUVD-2026-27175 HIGH

SQL Injection (CWE-89)

2026-05-05 Wordfence

WordPress SQLi Wordpress Plugin Geekybot Ai Copilot Chatbot Woocommerce Lead Gen Zero Prompt Content Ahmadgb

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 04:30 vuln.today

DescriptionCVE.org

The GeekyBot - Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to SQL Injection via the 'attributekey' parameter in versions up to, and including, 1.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

Unauthenticated SQL injection in GeekyBot WordPress plugin allows remote attackers to extract sensitive database contents via the 'attributekey' parameter. Affects all versions through 1.2.0. The CVSS 7.5 rating reflects network-based exploitation requiring no authentication or user interaction, with high confidentiality impact. Wordfence Threat Intelligence identified this vulnerability, with a patch committed in changeset 3474168. No active exploitation confirmed in CISA KEV at time of analysis, though the trivial attack complexity (AC:L) and unauthenticated vector (PR:N) make this a realistic target for automated scanning and exploitation.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a WordPress plugin that provides AI chatbot and lead generation functionality. The vulnerability exists in server-side code processing the 'attributekey' parameter, where user input is concatenated directly into SQL queries without proper parameterization or escaping. The affected component is cpe:2.3:a:ahmadgb:geekybot_-_ai_copilot,_chatbot,_woocommerce_lead_gen_&_zero-prompt_content through version 1.2.0. SQL injection occurs when untrusted data is inserted into SQL commands, allowing attackers to manipulate query logic. In WordPress plugins, this commonly affects AJAX handlers, REST API endpoints, or admin-ajax.php actions that process user-controlled parameters. The lack of prepared statements or WordPress's $wpdb->prepare() function enables attackers to inject arbitrary SQL commands, bypassing intended query structure to access unauthorized data.

RemediationAI

Update GeekyBot plugin to version 1.2.1 or later, which includes the security fix committed in WordPress Plugin Trac changeset 3474168 available at https://plugins.trac.wordpress.org/changeset/3474168/geeky-bot. WordPress administrators should access Dashboard > Plugins > Installed Plugins and update GeekyBot immediately. Verify the update by checking plugin version displays 1.2.1+ in the plugins list. If immediate patching is not feasible, disable the GeekyBot plugin entirely until update can be applied - this eliminates the attack surface but removes all chatbot and lead generation functionality dependent on the plugin. Do not attempt to filter the 'attributekey' parameter at the web application firewall level, as SQLi payloads are highly polymorphic and encoding-based bypasses are trivial; only the upstream code fix provides complete protection. After patching, review database access logs for suspicious queries containing UNION, SELECT, or other SQL keywords concatenated with attributekey values between initial disclosure and patch deployment. For additional defense, ensure WordPress database user permissions follow least privilege (no FILE, PROCESS, or SUPER privileges) to limit damage from any future SQLi exploitation.