CVE-2026-3456: WordPress GeekyBot Plugin SQL Injection
The National Vulnerability Database (NVD) reports CVE-2026-3456, a high-severity SQL Injection vulnerability affecting The GeekyBot – Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress, specifically versions up to and including 1.2.0. This flaw stems from insufficient escaping of user-supplied parameters and inadequate preparation of existing SQL queries, earning it a CVSS score of 7.5 (HIGH).
This vulnerability allows unauthenticated attackers to append arbitrary SQL queries, enabling them to extract sensitive information directly from the compromised database. The attack vector is remote via the network, requires no privileges, and no user interaction, making it a critical concern for any organization running affected WordPress sites.
Attackers are always looking for low-hanging fruit. A plugin like this, designed to enhance content and lead generation, often has direct access to critical database functions and user data. Exploiting this SQLi means bypassing authentication and gaining direct access to sensitive data that could include user credentials, PII, or internal system configurations. This is a direct path to data exfiltration and further system compromise.
What This Means For You
- If your organization uses The GeekyBot – Generate AI Content Without Prompt, Chatbot and Lead Generation plugin on your WordPress sites, you need to immediately check its version. Prioritize updating to a patched version or disabling the plugin until a fix is confirmed. Assume compromise and audit your database logs for unusual activity if you've been running an affected version.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-3456: WordPress GeekyBot Plugin SQL Injection Attempt
title: CVE-2026-3456: WordPress GeekyBot Plugin SQL Injection Attempt
id: scw-2026-05-05-ai-1
status: experimental
level: high
description: |
Detects SQL injection attempts targeting the WordPress GeekyBot plugin by looking for the vulnerable 'attributekey' parameter in the URI query string. This is the primary indicator of exploitation for CVE-2026-3456.
author: SCW Feed Engine (AI-generated)
date: 2026-05-05
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-3456/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- "attributekey=NULL"
- "attributekey=0"
- "attributekey=1"
cs-uri|contains:
- "/wp-content/plugins/geekybot/"
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-3456 | SQLi | WordPress plugin: GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation |
| CVE-2026-3456 | SQLi | Affected versions: <= 1.2.0 |
| CVE-2026-3456 | SQLi | Vulnerable parameter: 'attributekey' |
| CVE-2026-3456 | SQLi | Attack vector: Unauthenticated SQL Injection |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 05, 2026 at 07:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-7823: Critical Command Injection in Totolink A8000RU Routers
CVE-2026-7823 — A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setAppFilterCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the...
CVE-2026-7822 — Itsourcecode Courier Management System SQL Injection
CVE-2026-7822 — A vulnerability was identified in itsourcecode Courier Management System 1.0. This impacts an unknown function of the file /print_pdets.php. The manipulation of the...
CVE-2026-7812: Remote Command Injection in 54yyyu code-mcp MCP Tool
CVE-2026-7812 — A vulnerability was found in 54yyyu code-mcp up to 4cfc4643541a110c906d93635b391bf7e357f4a8. The impacted element is the function git_operation of the file src/code_mcp/server.py of the...