What is the CVSS score of CVE-2026-5294?

CVE-2026-5294 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Geeky Bot are affected by CVE-2026-5294?

Geeky Bot WordPress plugin versions 1.2.2 and earlier contain a critical remote code execution vulnerability that allows unauthenticated attackers to install malicious plugins and execute arbitrary…

How to fix or mitigate CVE-2026-5294?

Within 24 hours: identify all WordPress installations running Geeky Bot plugin ≤1.2.2 using inventory tools and disable or deactivate the plugin immediately. Within 7 days: remove the Geeky Bot plugin entirely from all instances and audit installed plugins for unauthorized additions created via this vulnerability. Within 30 days: establish a process to monitor WordPress plugin versions and implement a policy restricting plugin use to only reviewed, maintained solutions; migrate to alternative functionality if Geeky Bot is business-critical.

Geeky Bot CVE-2026-5294

EUVD-2026-27193 CRITICAL

Missing Authorization (CWE-862)

2026-05-05 Wordfence

GHSA-g79m-g3fv-4rq9

Authentication Bypass RCE WordPress

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 04:30 vuln.today

DescriptionCVE.org

The Geeky Bot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.2.2. This is due to a nopriv AJAX route allowing attacker-controlled model/function dispatch and reaching a plugin installer helper that downloads and unzips attacker-supplied ZIP files into wp-content/plugins/. This makes it possible for unauthenticated attackers to perform arbitrary plugin installation and achieve remote code execution.

AnalysisAI

Remote code execution in Geeky Bot WordPress plugin versions ≤1.2.2 allows unauthenticated attackers to install arbitrary plugins and execute code on affected sites. The vulnerability exploits a missing authorization check in a nopriv AJAX handler that permits attacker-controlled function dispatch to a plugin installer, enabling download and extraction of malicious ZIP files directly into wp-content/plugins/. With CVSS 9.8 (critical), network-exploitable without authentication, and EPSS data unavailable, this represents a severe risk to all WordPress sites running vulnerable versions until patched.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization), specifically in WordPress's AJAX handling architecture. WordPress provides two AJAX hook types: wp_ajax_{action} for authenticated users and wp_ajax_nopriv_{action} for unauthenticated requests. Geeky Bot incorrectly registered a nopriv handler that accepts arbitrary model and function parameters, creating a dangerous function dispatch mechanism accessible without authentication. The attacker can route requests through this handler to reach internal plugin installation helpers that download ZIP archives from attacker-controlled URLs and extract them into the WordPress plugins directory. Once a malicious plugin is installed with executable PHP code, the attacker gains remote code execution with the web server's privileges. The affected product CPE (a:ahmadgb:geekybot_-_ai_copilot,_chatbot,_woocommerce_lead_gen_&_zero-prompt_content) indicates this is a multi-function AI assistant plugin, likely featuring chatbot and content generation capabilities that require AJAX endpoints for dynamic interactions.

RemediationAI

Immediately upgrade Geeky Bot plugin to version 1.2.3 or later through the WordPress admin dashboard (Plugins → Updates) or by downloading from the official WordPress plugin repository. The security fix is documented in Trac changeset 3497169 at https://plugins.trac.wordpress.org/changeset/3497169/geeky-bot, which addresses the missing authorization check in the AJAX handler. If immediate patching is not possible, disable the Geeky Bot plugin entirely until upgrade can be completed - this is the only effective workaround since the vulnerability exists in unauthenticated code paths that cannot be mitigated through access controls. Do NOT attempt to restrict AJAX endpoints via .htaccess or WAF rules, as WordPress's admin-ajax.php is required for legitimate site functionality and blocking it will break other plugins. After patching, review installed plugins in wp-content/plugins/ for any unauthorized additions (check file modification timestamps against attack timeline) and examine web server access logs for POST requests to /wp-admin/admin-ajax.php with suspicious action parameters. Consider implementing a Web Application Firewall with WordPress-specific rulesets to detect future plugin installation attempts, though this is supplementary to patching, not a replacement.