EUVD-2026-36956
GHSA-67gj-5jwj-xjgh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running GeekyBot ≤1.2.0
-
DeliverySend crafted HTTP request with SQL payload
-
ExploitTrigger injection in vulnerable plugin endpoint
-
ExecutionExfiltrate wp_users hashes and secrets
-
ImpactCrack or replay credentials for admin takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the GeekyBot WordPress plugin version 1.2.0 or earlier, reachable over HTTP/HTTPS on the WordPress site. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and no elevated attack complexity is required. The only limiting factor is plugin presence: the site must have GeekyBot installed and activated, and the vulnerable endpoint must be reachable (typically true for any internet-facing WordPress install, since WordPress plugin AJAX/REST endpoints are usually exposed at /wp-admin/admin-ajax.php or /wp-json/ regardless of frontend authentication). |
| Impact | Signals are mixed but lean toward elevated priority for any site with the plugin installed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a trivially exploitable network-reachable bug with no privileges or interaction required, and the 9.3 score is driven largely by S:C and C:H - confidentiality is high while integrity is rated N and availability only Low, which is somewhat unusual for SQLi and suggests Patchstack may have observed only read-side impact (or this could be a conservative scoring choice - the CWE-89 root cause typically also implies integrity risk, so defenders should not rely on I:N as a hard guarantee). EPSS score was not provided in the input, and the CVE is not in CISA KEV, so widespread automated exploitation is unconfirmed; however, WordPress plugin SQLi flaws are routinely incorporated into mass-scanning toolkits within days of disclosure, and the unauthenticated nature means any internet-exposed install is reachable. Treat as a high-priority patch for affected sites. |
| Exploit ScenarioDerived | An unauthenticated attacker scans the internet for WordPress sites running the GeekyBot plugin and sends a crafted HTTP request to a vulnerable plugin endpoint with a malicious SQL payload in a parameter. The injected query extracts WordPress administrator password hashes, secret keys, or session tokens from wp_users and wp_options, which the attacker then cracks offline or replays to seize full site control. No public proof-of-concept has been published yet, but the bug class is well understood and PoCs commonly appear shortly after Patchstack disclosures. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 15, 2026
Unauthenticated SQL injection in the GeekyBot WordPress plugin versions 1.2.0 and earlier allows remote attackers to inject arbitrary SQL queries against the WordPress database without any authentication or user interaction. The flaw was disclosed via Patchstack and carries a high CVSS 3.1 score of 9.3 with scope change, indicating impact beyond the plugin's own security context. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis - the EUVD entry lists the fixed version as 'n/a' and no patched release is cited in the references. Until the plugin author publishes a fix above 1.2.0, the most reliable mitigation is to deactivate and remove the GeekyBot plugin from affected WordPress sites; this eliminates exposure but removes any chatbot functionality the plugin provided. As compensating controls, deploy a WAF with WordPress-specific SQLi rulesets (Patchstack, Wordfence, or equivalent) to filter suspicious query parameters reaching the plugin's endpoints - this reduces but does not eliminate risk and may produce false positives on legitimate traffic. Monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/geeky-bot/vulnerability/wordpress-geekybot-plugin-1-2-0-sql-injection-vulnerability for an updated fixed version, and restrict outbound database connectivity and review wp_users / wp_options for unauthorized changes as a defensive baseline.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GeekyBot is a WordPress plugin (CPE cpe:2.3:a:ahmad:geekybot) that, like most WordPress extensions, interacts with the underlying MySQL/MariaDB database via the global $wpdb abstraction. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) indicates that user-controllable input is concatenated into SQL statements without proper use of prepared statements or $wpdb->prepare() sanitization, allowing query structure manipulation. The scope change (S:C) in the CVSS vector reflects that injected SQL can read or affect WordPress core tables - including wp_users and wp_options - which lie outside the plugin's intended security boundary.
Know when Geekybot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N); scope change to WP core tables (S:C); high read impact, but realistic SQLi also permits limited writes so I:L rather than I:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions.
Executive ViewAI
GeekyBot WordPress plugin versions 1.2.0 and earlier contain an unauthenticated SQL injection vulnerability allowing attackers to extract or modify WordPress database contents without credentials or user action. Organizations using this plugin face immediate risk of data theft, account compromise, and system manipulation. The vulnerability affects any site running the affected plugin, regardless of network security controls or user access restrictions.
Immediate plugin removal is primary control. If retention required: deploy WAF with SQL injection signatures; restrict database user permissions to read-only or specific tables; enable database access logging and real-time alerting; implement network segmentation isolating WordPress database server; consider database activity monitoring (DAM) solution for query-level anomaly detection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Unauthenticated arbitrary file upload in the GeekyBot WordPress plugin (versions 1.2.2 and earlier) allows remote attack
SQL injection in the GeekyBot WordPress plugin (versions 1.2.5 and earlier) allows unauthenticated remote attackers to i
Unauthenticated XSS in the GeekyBot WordPress plugin (versions 1.2.6 and below) allows a remote, unauthenticated attacke
Exploit-DB