CVE-2026-5294
Missing Authorization in Geeky Bot WordPress Plugin
Publication date: 2026-05-05
Last updated on: 2026-05-05
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| geeky_bot | geeky_bot | to 1.2.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Geeky Bot plugin for WordPress, in versions up to and including 1.2.2, has a vulnerability due to a missing authorization check. Specifically, an unauthenticated attacker can access a nopriv AJAX route that allows them to control which model or function is dispatched. This leads to reaching a plugin installer helper that can download and unzip attacker-supplied ZIP files into the wp-content/plugins/ directory.
As a result, attackers can install arbitrary plugins without authentication, which can lead to remote code execution on the affected WordPress site.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including allowing unauthenticated attackers to install arbitrary plugins on your WordPress site.
Such unauthorized plugin installation can lead to remote code execution, meaning attackers can execute malicious code on your server, potentially taking full control of your website and underlying system.
This can result in data breaches, defacement, service disruption, or further compromise of your infrastructure.