EUVD-2026-41288
GHSA-fj33-458m-h9j3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running GeekyBot ≤1.2.5
-
DeliverySend crafted request with SQL payload
-
ExploitInjection executes in database query
-
ExecutionExtract user and credential data
-
ImpactEscalate to full site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against GeekyBot plugin versions <= 1.2.5, consistent with the AV:N/AC:L/PR:N/UI:N vector, requires only that the plugin is installed and active on a reachable WordPress site. The primary limiting factor is deployment scope: the target must have the specific GeekyBot plugin installed and its vulnerable endpoint network-accessible. The exact vulnerable parameter, endpoint, and whether reachability depends on a particular plugin feature being enabled are not specified in the available data and should be confirmed against the Patchstack advisory. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3) describes a high-severity, easily reachable, unauthenticated attack with a scope change, which is consistent with SQL injection that can read data across the shared WordPress database. The scope change (S:C) and C:H reflect cross-boundary confidentiality impact, while I:N/A:L suggest the reported vector is read/extraction-oriented rather than full database write or destruction - though in practice many SQLi flaws permit broader impact than the assigned integrity metric implies, so this should be treated cautiously. No EPSS score, KEV listing, POC, or SSVC decision data was provided; the absence of an EPSS/KEV signal means real-world exploitation is unconfirmed, so priority rests on the low attack complexity and unauthenticated reachability rather than on evidence of active exploitation. Overall this is a genuine high-priority patch item for anyone running the plugin, tempered only by the plugin's likely small deployment footprint. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a WordPress site running GeekyBot <= 1.2.5 and sends a crafted HTTP request to a vulnerable plugin endpoint containing malicious SQL in a parameter. Because no authentication or user interaction is required (AV:N/PR:N/UI:N/AC:L), the injected query executes against the site database, allowing extraction of sensitive data such as user records and password hashes from wp_users. No public proof-of-concept was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 02, 2026
SQL injection in the GeekyBot WordPress plugin (versions 1.2.5 and earlier) allows unauthenticated remote attackers to inject arbitrary SQL into backend database queries per the CVSS PR:N vector. Reported by Patchstack and rated CVSS 9.3 (critical) with a scope-changed vector, the flaw enables confidentiality-impacting data extraction from the WordPress database without any authentication or user interaction. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
RemediationAI
No vendor-released patch version was identified at time of analysis, so no fixed release can be cited from the input; monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/geeky-bot/vulnerability/wordpress-geekybot-plugin-1-2-5-sql-injection-vulnerability?_s_id=cve) and the WordPress plugin repository for an update beyond 1.2.5 and apply it as the primary fix. Until a patched version is confirmed, the most effective compensating control is to deactivate and remove the GeekyBot plugin, which fully eliminates the exposure at the cost of losing the plugin's functionality. If removal is not acceptable, deploy a WordPress WAF (such as Patchstack's virtual patching) or a WAF rule set to filter SQL injection patterns against the plugin's endpoints, accepting that WAF rules can be bypassed and may cause false positives; additionally restrict access to the affected plugin endpoints at the web-server or firewall level and ensure database backups and least-privilege database accounts are in place to limit data exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GeekyBot (vendor 'ahmadgb', CPE cpe:2.3:a:ahmadgb:geekybot) is a WordPress plugin that extends site functionality within the PHP/MySQL WordPress stack. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input reaches a database query - typically via WordPress's $wpdb interface - without proper parameterization or escaping. Because WordPress plugins share the site's single MySQL/MariaDB database, an injection point in the plugin can reach core tables such as wp_users and wp_options, not just the plugin's own data.
Know when Geekybot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N) reads across the shared WordPress DB (S:C, C:H); reported vector shows limited integrity/availability impact (I:N/A:L).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated SQL Injection in GeekyBot <= 1.2.5 versions.
Executive ViewAI
The GeekyBot WordPress plugin (versions 1.2.5 and earlier) contains a critical SQL injection vulnerability allowing unauthenticated attackers to extract sensitive data directly from WordPress databases without user interaction. No public exploit has been identified at time of analysis, but the vulnerability's high severity makes it a significant business risk to any organization using this plugin. Immediate action to identify and disable affected installations is required to prevent unauthorized database access and customer data exposure.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately deactivate the vulnerable plugin; (2) Implement Web Application Firewall (WAF) rules to block SQL injection patterns targeting WordPress endpoints; (3) Restrict database user privileges to least-required permissions; (4) Monitor database query logs for injection attempts; (5) Consider isolating WordPress instances to segmented network zones with restricted external access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Unauthenticated arbitrary file upload in the GeekyBot WordPress plugin (versions 1.2.2 and earlier) allows remote attack
Unauthenticated SQL injection in the GeekyBot WordPress plugin versions 1.2.0 and earlier allows remote attackers to inj
Unauthenticated XSS in the GeekyBot WordPress plugin (versions 1.2.6 and below) allows a remote, unauthenticated attacke
Exploit-DB