What is the CVSS score of CVE-2026-57679?

CVE-2026-57679 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of GeekyBot are affected by CVE-2026-57679?

The GeekyBot WordPress plugin (versions 1.2.5 and earlier) contains a critical SQL injection vulnerability allowing unauthenticated attackers to extract sensitive data directly from WordPress…

How to fix or mitigate CVE-2026-57679?

Within 24 hours: Conduct inventory of all WordPress installations using GeekyBot plugin (versions 1.2.5 or earlier) and immediately deactivate/remove the plugin; notify all affected stakeholders of potential exposure. Within 7 days: Review database access logs for suspicious SQL activity or unauthorized queries; assess whether database contents were accessed or exfiltrated during the exposure window. Within 30 days: Monitor Patchstack security advisories for patched versions; when released, update to the latest GeekyBot version and conduct post-patch security validation.

GeekyBot CVE-2026-57679

EUVD-2026-41288 CRITICAL

SQL Injection (CWE-89)

2026-07-02 Patchstack

GHSA-fj33-458m-h9j3

WordPress SQLi Wordpress Plugin Geekybot Ahmadgb

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N) reads across the shared WordPress DB (S:C, C:H); reported vector shows limited integrity/availability impact (I:N/A:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:03 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in GeekyBot <= 1.2.5 versions.

AnalysisAI

SQL injection in the GeekyBot WordPress plugin (versions 1.2.5 and earlier) allows unauthenticated remote attackers to inject arbitrary SQL into backend database queries per the CVSS PR:N vector. Reported by Patchstack and rated CVSS 9.3 (critical) with a scope-changed vector, the flaw enables confidentiality-impacting data extraction from the WordPress database without any authentication or user interaction. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

GeekyBot (vendor 'ahmadgb', CPE cpe:2.3:a:ahmadgb:geekybot) is a WordPress plugin that extends site functionality within the PHP/MySQL WordPress stack. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input reaches a database query - typically via WordPress's $wpdb interface - without proper parameterization or escaping. Because WordPress plugins share the site's single MySQL/MariaDB database, an injection point in the plugin can reach core tables such as wp_users and wp_options, not just the plugin's own data.

RemediationAI

No vendor-released patch version was identified at time of analysis, so no fixed release can be cited from the input; monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/geeky-bot/vulnerability/wordpress-geekybot-plugin-1-2-5-sql-injection-vulnerability?_s_id=cve) and the WordPress plugin repository for an update beyond 1.2.5 and apply it as the primary fix. Until a patched version is confirmed, the most effective compensating control is to deactivate and remove the GeekyBot plugin, which fully eliminates the exposure at the cost of losing the plugin's functionality. If removal is not acceptable, deploy a WordPress WAF (such as Patchstack's virtual patching) or a WAF rule set to filter SQL injection patterns against the plugin's endpoints, accepting that WAF rules can be bypassed and may cause false positives; additionally restrict access to the affected plugin endpoints at the web-server or firewall level and ensure database backups and least-privilege database accounts are in place to limit data exposure.