high7.5
CVE-2026-15048
The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat…
Impact
The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and timestamps.
Affected products
| Product | Affected versions |
|---|---|
| Geeky Bot WordPress Plugin | before 1.2.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.