CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Geeky Bot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.2.2. This is due to a nopriv AJAX route allowing attacker-controlled model/function dispatch and reaching a plugin installer helper that downloads and unzips attacker-supplied ZIP files into wp-content/plugins/. This makes it possible for unauthenticated attackers to perform arbitrary plugin installation and achieve remote code execution.
Explanation of Vulnerability in Simple Terms
GeekyBot versions up to 1.2.2 lack proper authorization checks, allowing unauthenticated attackers to perform sensitive actions over the network without user interaction. The vulnerability affects confidentiality, integrity, and availability of the affected system. Update to a version newer than 1.2.2 to remediate.
What an attacker can do
Read, modify, or delete data and disrupt service without logging in.
Potential impact on your site
Attackers can access, modify, or delete any data in GeekyBot without credentials.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
