What is the CVSS score of CVE-2026-39519?

CVE-2026-39519 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of GeekyBot are affected by CVE-2026-39519?

GeekyBot WordPress plugin versions 1.2.0 and earlier contain an unauthenticated SQL injection vulnerability allowing attackers to extract or modify WordPress database contents without credentials or…

How to fix or mitigate CVE-2026-39519?

24 hours: Inventory all WordPress instances running GeekyBot plugin; immediately disable and remove the plugin; review database access logs for suspicious queries. 7 days: If removal is operationally infeasible, implement Web Application Firewall (WAF) rules blocking SQL injection patterns, enforce database-level access restrictions with least-privilege accounts, and enable database query auditing. 30 days: Establish monitoring for GeekyBot patch release; evaluate replacement plugin functionality; conduct forensic database audit to detect prior exploitation.

GeekyBot CVE-2026-39519

EUVD-2026-36956 CRITICAL

SQL Injection (CWE-89)

2026-06-15 Patchstack

GHSA-67gj-5jwj-xjgh

WordPress SQLi Wordpress Plugin Geekybot Ahmad

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.9 CRITICAL

Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N); scope change to WP core tables (S:C); high read impact, but realistic SQLi also permits limited writes so I:L rather than I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:20 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions.

AnalysisAI

Unauthenticated SQL injection in the GeekyBot WordPress plugin versions 1.2.0 and earlier allows remote attackers to inject arbitrary SQL queries against the WordPress database without any authentication or user interaction. The flaw was disclosed via Patchstack and carries a high CVSS 3.1 score of 9.3 with scope change, indicating impact beyond the plugin's own security context. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

GeekyBot is a WordPress plugin (CPE cpe:2.3:a:ahmad:geekybot) that, like most WordPress extensions, interacts with the underlying MySQL/MariaDB database via the global $wpdb abstraction. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) indicates that user-controllable input is concatenated into SQL statements without proper use of prepared statements or $wpdb->prepare() sanitization, allowing query structure manipulation. The scope change (S:C) in the CVSS vector reflects that injected SQL can read or affect WordPress core tables - including wp_users and wp_options - which lie outside the plugin's intended security boundary.

RemediationAI

No vendor-released patch identified at time of analysis - the EUVD entry lists the fixed version as 'n/a' and no patched release is cited in the references. Until the plugin author publishes a fix above 1.2.0, the most reliable mitigation is to deactivate and remove the GeekyBot plugin from affected WordPress sites; this eliminates exposure but removes any chatbot functionality the plugin provided. As compensating controls, deploy a WAF with WordPress-specific SQLi rulesets (Patchstack, Wordfence, or equivalent) to filter suspicious query parameters reaching the plugin's endpoints - this reduces but does not eliminate risk and may produce false positives on legitimate traffic. Monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/geeky-bot/vulnerability/wordpress-geekybot-plugin-1-2-0-sql-injection-vulnerability for an updated fixed version, and restrict outbound database connectivity and review wp_users / wp_options for unauthorized changes as a defensive baseline.