PT-2026-36963 · WordPress · Geekybot

Published 2026-05-05 · Updated 2026-05-05 · CVE-2026-3456

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress versions prior to 1.2.1

Description Insufficient escaping of user-supplied parameters and lack of proper preparation in SQL queries allow unauthenticated attackers to perform SQL Injection. By appending additional SQL queries via the attributekey parameter, an attacker can extract sensitive information from the database.

Recommendations Update the plugin to a version later than 1.2.0. As a temporary workaround, restrict access to the functionality utilizing the attributekey parameter.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-3456

Affected Products

Geekybot

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-3456 · Security Note
• https://i.redd.it/v5zmm5aqqczg1.png · Reddit Post
• https://twitter.com/CVEarity/status/2051612209625841958 · Twitter Post
• https://t.me/cveNotify/162131 · Telegram Post
• https://t.me/CVEtracker/52706 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3474168/geeky-bot · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4c716fd3-6297-4b3a-a796-65f68f2986cf?source=cve · Note