EUVD-2026-36981
GHSA-jcp9-7cp3-7w4x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running GeekyBot ≤1.2.2
-
DeliverySend unauthenticated POST to plugin upload endpoint
-
ExploitUpload PHP webshell bypassing type check
-
ExecutionRequest shell URL to execute commands
-
PersistRead wp-config.php and create admin user
-
ImpactEstablish persistence and pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the GeekyBot WordPress plugin at versions ≤1.2.2, as long as the plugin is installed and activated on an internet-reachable WordPress site. The only limiting factors are that the target must have GeekyBot enabled (it is a third-party plugin, not core WordPress, so install base is bounded by the plugin's popularity) and the webserver must be configured to execute PHP from the upload destination directory for the file-write to escalate to code execution - a configuration that is the default on virtually all shared-hosting and stock LAMP WordPress deployments. |
| Impact | All signals point to maximum priority: CVSS 3.1 base score 10.0 with AV:N/AC:L/PR:N/UI:N (no auth, no UI, low complexity) and S:C/C:H/I:H/A:H (scope change with total impact), CWE-434 arbitrary file upload is in the SANS Top 25 and historically among the most reliably exploited bug classes on WordPress, and the affected vector is a public-facing CMS plugin. EPSS and KEV data were not provided in the input - KEV status is therefore unconfirmed and active exploitation cannot be asserted - but Patchstack disclosures of unauthenticated upload bugs in WP plugins are typically scanned for by mass-exploitation botnets within days of publication. The combination of no preconditions, trivial weaponization, and a vast install base of vulnerable WordPress instances makes this a real, near-term priority rather than a high-CVSS-but-low-real-risk case. |
| Exploit ScenarioDerived | An unauthenticated attacker scans the internet for WordPress sites running GeekyBot, sends a single crafted HTTP POST to the plugin's vulnerable upload endpoint carrying a PHP webshell disguised or named as a permitted type, and on success the file lands in a web-accessible directory. The attacker then requests the uploaded file's URL to execute commands as the webserver user, pivoting to database credential theft via wp-config.php, persistent admin user creation, and full site takeover. No public exploit identified at time of analysis, but CWE-434 bugs of this class are trivially weaponized once the endpoint is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 15, 2026
Unauthenticated arbitrary file upload in the GeekyBot WordPress plugin (versions 1.2.2 and earlier) allows remote attackers to upload arbitrary files, including PHP webshells, to the web server without any authentication. Reported by Patchstack and tracked as EUVD-2026-36981, this issue carries a maximum 10.0 CVSS due to network-reachable exploitation with no privileges, no user interaction, and a scope change leading to full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, though the CWE-434 class is heavily targeted on WordPress plugins and routinely leads to full site compromise once disclosed.
RemediationAI
No vendor-released patch identified at time of analysis - the Patchstack advisory references versions ≤1.2.2 as vulnerable without naming a fixed release, so administrators should monitor the Patchstack entry (https://patchstack.com/database/wordpress/plugin/geeky-bot/vulnerability/wordpress-geekybot-plugin-1-2-2-arbitrary-file-upload-vulnerability) and the WordPress.org plugin page for a 1.2.3+ release and upgrade immediately when available. Until a fix ships, the safest control is to deactivate and remove the GeekyBot plugin entirely (trade-off: loss of plugin functionality); if removal is not possible, deploy a WAF rule (Patchstack, Wordfence, or equivalent virtual patch) blocking uploads to the plugin's endpoint, restrict access to wp-admin/admin-ajax.php and any GeekyBot REST routes by IP, and add a webserver rule denying PHP execution under wp-content/uploads/ (e.g., an Apache <Directory> handler override or nginx location block) - note this last control can break legitimate plugins that rely on executing PHP from the uploads tree.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GeekyBot is a third-party WordPress plugin (CPE cpe:2.3:a:ahmad:geekybot) that, like many WP plugins, exposes server-side endpoints via the admin-ajax.php or REST routes. CWE-434 (Unrestricted Upload of File with Dangerous Type) indicates the plugin's upload handler fails to validate file extension, MIME type, or content before writing user-supplied data into a web-accessible directory. In the WordPress ecosystem this almost always translates to writing a .php file under wp-content/uploads/ (or a plugin-specific folder) which is then directly executable by the PHP-FPM/Apache handler, turning the file write into arbitrary remote code execution under the web server user (www-data/apache).
Know when Geekybot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network-reachable upload endpoint (AV:N/AC:L/PR:N/UI:N); PHP write under WordPress yields RCE escaping the plugin sandbox to the host (S:C, C:H/I:H/A:H).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions.
Executive ViewAI
Any organization running the GeekyBot WordPress plugin (v1.2.2 and earlier) is exposed to complete site takeover and data loss through unauthenticated remote attackers uploading malicious code. The vendor has not released a patch, leaving removal as the only immediate mitigation. Affected websites could face financial impact through downtime, customer data exposure, and reputational damage from malware deployment.
Since no vendor-released patch identified at time of analysis: (1) Immediately remove or disable the plugin from all WordPress installations; (2) Implement Web Application Firewall rules to block file uploads to plugin directories; (3) Configure web server to disable PHP execution in upload directories via .htaccess or nginx config; (4) Restrict file write permissions in wp-content/uploads/ to image/document formats only; (5) Enable file integrity monitoring on web root to detect unauthorized file creation; (6) Review access logs for suspicious POST requests to plugin endpoints.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Unauthenticated SQL injection in the GeekyBot WordPress plugin versions 1.2.0 and earlier allows remote attackers to inj
SQL injection in the GeekyBot WordPress plugin (versions 1.2.5 and earlier) allows unauthenticated remote attackers to i
Unauthenticated XSS in the GeekyBot WordPress plugin (versions 1.2.6 and below) allows a remote, unauthenticated attacke
Exploit-DB