EUVD-2026-41288
GHSA-fj33-458m-h9j3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N) reads across the shared WordPress DB (S:C, C:H); reported vector shows limited integrity/availability impact (I:N/A:L).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated SQL Injection in GeekyBot <= 1.2.5 versions.
AnalysisAI
SQL injection in the GeekyBot WordPress plugin (versions 1.2.5 and earlier) allows unauthenticated remote attackers to inject arbitrary SQL into backend database queries per the CVSS PR:N vector. Reported by Patchstack and rated CVSS 9.3 (critical) with a scope-changed vector, the flaw enables confidentiality-impacting data extraction from the WordPress database without any authentication or user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against GeekyBot plugin versions <= 1.2.5, consistent with the AV:N/AC:L/PR:N/UI:N vector, requires only that the plugin is installed and active on a reachable WordPress site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3) describes a high-severity, easily reachable, unauthenticated attack with a scope change, which is consistent with SQL injection that can read data across the shared WordPress database. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a WordPress site running GeekyBot <= 1.2.5 and sends a crafted HTTP request to a vulnerable plugin endpoint containing malicious SQL in a parameter. Because no authentication or user interaction is required (AV:N/PR:N/UI:N/AC:L), the injected query executes against the site database, allowing extraction of sensitive data such as user records and password hashes from wp_users. … |
| Remediation | No vendor-released patch version was identified at time of analysis, so no fixed release can be cited from the input; monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/geeky-bot/vulnerability/wordpress-geekybot-plugin-1-2-5-sql-injection-vulnerability?_s_id=cve) and the WordPress plugin repository for an update beyond 1.2.5 and apply it as the primary fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct inventory of all WordPress installations using GeekyBot plugin (versions 1.2.5 or earlier) and immediately deactivate/remove the plugin; notify all affected stakeholders of potential exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file upload in the GeekyBot WordPress plugin (versions 1.2.2 and earlier) allows remote attack
Unauthenticated SQL injection in the GeekyBot WordPress plugin versions 1.2.0 and earlier allows remote attackers to inj
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today