Geeky Bot exposes chat-session metadata without authentication
Geeky Bot before 1.2.8 exposes its chat-history pagination through the public geekybot_ajax AJAX dispatcher without an authorization check. An unauthenticated visitor can POST action=geekybot_ajax, geekybotme=chathistory, task=getNextChatHistorySessions and an offset value to enumerate ten sessions per page. The response discloses WordPress display names, user IDs and chat timestamps; the published.
- Component
- Geeky Bot
- Plugin slug
geeky-bot- Affected
- < 1.2.8
- Safe version
1.2.8- Published
- Jul 31, 2026
This CVE was published Jul 31, 2026 and is one of 7 known issues for this plugin.
Update, patch or deactivate.
Update Geeky Bot to 1.2.8 or later. Review access logs for unauthenticated geekybot_ajax requests using the chathistory and getNextChatHistorySessions values, and evaluate the disclosed user identifiers and timestamps under the site's privacy and incident-response requirements.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and timestamps.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N