CVE Intelligence
Analysis AI-assisted

CVE-2026-5294: GeekyBot WordPress Plugin up to 1.2.2 - Missing Authorization Enables Unauthenticated Plugin Installation

CVE-2026-5294 affects the GeekyBot plugin for WordPress up to and including 1.2.2 and is classified as Missing Authorization (CWE-862). According to the record, an unauthenticated request path can reach a plugin installer helper, which may allow arbitrary plugin installation and remote code execution, with a CVSS 3.1 base score of 9.8 (Critical). No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-5294 is a Missing Authorization weakness (CWE-862) in the GeekyBot plugin for WordPress, affecting versions up to and including 1.2.2. The record describes a request handler reachable without authentication that can lead to a plugin installer helper. According to the record, this helper downloads and extracts attacker-supplied ZIP files into the wp-content/plugins directory.

Impact

The record states that unauthenticated attackers could perform arbitrary plugin installation and achieve remote code execution. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low complexity, no privileges or user interaction required, and high impact to confidentiality, integrity and availability. The base score is 9.8.

Affected products and versions

  • GeekyBot plugin for WordPress, versions 1.2.2 and earlier (up to and including 1.2.2).
  • The record does not list any fixed version.
  • The changeset referenced by the record (WordPress plugin trac, changeset 3497169) may relate to a remediation, but the record does not confirm its content or the first fixed version.

Exploitation status

The CISA KEV catalog entry in the record is marked as not listed. No confirmed active exploitation or exploitation in the wild appears in the sources consulted. The SSVC record shows exploitation as none and automatable as yes. The EPSS probability in the record is 0.00818 (percentile 0.56033). These values describe modeled likelihood and do not confirm observed attacks.

Remediation and mitigation

  • Identify all WordPress sites running GeekyBot and confirm the installed version.
  • Check the referenced Wordfence advisory and WordPress plugin changeset for the vendor-confirmed fixed version, and update to a release that is confirmed to be fixed.
  • If the plugin is not required, deactivate and remove it.
  • Restrict write access to wp-content/plugins where operationally possible, and keep WordPress core and other plugins updated.
  • Review whether the site is exposed to the internet and apply network-level restrictions to administrative and AJAX endpoints where practical.

Detection guidance

  • Review wp-content/plugins for unfamiliar or recently created plugin directories and unexpected files.
  • Review WordPress and hosting logs for unexpected plugin installation or activation events.
  • Review web server logs for unusual volumes of requests to admin-ajax.php from unauthenticated sources.
  • Compare installed plugin lists against an approved inventory.

Limitations of the available information

The record does not provide the first fixed version, detailed affected function names beyond the record description, or confirmed proof of exploitation. The EPSS date in the record is later than the publication date, so the scoring context should be verified against the EPSS source before relying on it. Vendor and Wordfence advisory content was not reviewed beyond what the record states.

Frequently asked questions

What is CVE-2026-5294?

It is a Missing Authorization vulnerability (CWE-862) in the GeekyBot WordPress plugin, versions up to and including 1.2.2, which the record says can allow unauthenticated arbitrary plugin installation.

Is CVE-2026-5294 known to be actively exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do now?

Confirm the installed GeekyBot version, check the referenced advisory and changeset for the confirmed fixed version, update or remove the plugin, and review plugin directories and logs for unexpected activity.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.