Geeky Bot EUVD-2026-51425

Exploitation requires that the Geeky Bot WordPress plugin version below 1.2.8 is installed and active on the target site, and that the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) is reachable over the network - the default state for any publicly accessible WordPress installation. The CVSS vector confirms PR:N, meaning no authentication of any kind is required. Chat-history sessions must exist in the database to return meaningful data, though the endpoint itself is exploitable regardless. Exploitation is constrained by: (1) the plugin must be installed and activated, which limits the attack surface to sites specifically deploying Geeky Bot; (2) the affected AJAX endpoint must not be blocked by an intervening WAF or firewall rule for unauthenticated requests; (3) no special configuration, non-default setting, or privileged access is required - the flaw is present in the default plugin state.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5 High) accurately reflects the technical ease of exploitation: network-reachable, no complexity, no authentication, no interaction required. However, real-world risk signals counsel a measured response. EPSS at 0.14% (4th percentile) indicates the vulnerability is not currently seeing automated or broad exploitation in the wild; no CISA KEV entry confirms active exploitation. The counterweight is a publicly available POC via WPScan, which eliminates the technical skill barrier for targeted attackers. The confidentiality impact is meaningful - WordPress usernames and user IDs directly enable credential-stuffing campaigns, targeted phishing, and account enumeration - but integrity and availability are unaffected. Organizational risk scales with plugin deployment prevalence: for any site running Geeky Bot with an internet-accessible AJAX endpoint and existing chat sessions, exploitation requires zero attacker resources. The low EPSS versus high CVSS contrast is typical of niche-plugin flaws where the affected product footprint limits opportunistic targeting despite technical ease.

An attacker discovers a publicly accessible WordPress site via Google dorking or WordPress plugin enumeration, confirms the Geeky Bot plugin is active by checking plugin-specific asset paths, then sends a crafted unauthenticated HTTP POST request to /wp-admin/admin-ajax.php targeting the unprotected AJAX action using the publicly available WPScan POC. The response returns chat-history session metadata containing WordPress usernames and user IDs, which the attacker feeds into a credential-stuffing tool or uses to craft targeted phishing emails against the site's known user list.