CVE-2026-5294
Deferred Deferred - Pending Action

Missing Authorization in Geeky Bot WordPress Plugin

Publication date: 2026-05-05

Last updated on: 2026-05-05

Assigner: Wordfence

Description
The Geeky Bot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.2.2. This is due to a nopriv AJAX route allowing attacker-controlled model/function dispatch and reaching a plugin installer helper that downloads and unzips attacker-supplied ZIP files into wp-content/plugins/. This makes it possible for unauthenticated attackers to perform arbitrary plugin installation and achieve remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-05-05
Last Modified
2026-05-05
Generated
2026-07-06
AI Q&A
2026-05-05
EPSS Evaluated
2026-07-05
NVD
CVE-2026-5294
EUVD
EUVD-2026-27193

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
geeky_bot geeky_bot to 1.2.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Geeky Bot plugin for WordPress, in versions up to and including 1.2.2, has a vulnerability due to a missing authorization check. Specifically, an unauthenticated attacker can access a nopriv AJAX route that allows them to control which model or function is dispatched. This leads to reaching a plugin installer helper that can download and unzip attacker-supplied ZIP files into the wp-content/plugins/ directory.

As a result, attackers can install arbitrary plugins without authentication, which can lead to remote code execution on the affected WordPress site.

Impact Analysis

This vulnerability can have severe impacts including allowing unauthenticated attackers to install arbitrary plugins on your WordPress site.

Such unauthorized plugin installation can lead to remote code execution, meaning attackers can execute malicious code on your server, potentially taking full control of your website and underlying system.

This can result in data breaches, defacement, service disruption, or further compromise of your infrastructure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-5294. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart