CVE-2026-5294: Critical RCE in Geeky Bot WordPress Plugin

The National Vulnerability Database has disclosed a critical vulnerability, CVE-2026-5294, affecting the Geeky Bot plugin for WordPress, specifically versions up to and including 1.2.2. This flaw, rated 9.8 CVSS (Critical), stems from a missing authorization check within a nopriv AJAX route.

This architectural oversight allows unauthenticated attackers to dispatch attacker-controlled models and functions. Critically, it reaches a plugin installer helper, enabling the download and unzipping of attacker-supplied ZIP files directly into wp-content/plugins/. The implication is straightforward: unauthenticated attackers can perform arbitrary plugin installations, leading directly to remote code execution (RCE).

This isn’t just a configuration issue; it’s a fundamental design flaw. For defenders, it means any WordPress site running this plugin is an open door for full system compromise. The attacker’s calculus is simple: find a vulnerable site, upload a malicious plugin, and own the server. There’s no complex chain, no user interaction needed. It’s a direct path to RCE, making it a prime target for opportunistic attackers.