The GeekyBot — Generate AI Content Without Prompt

CVE-2026-3456 is an unauthenticated SQL injection in the WordPress plugin GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content. Per NVD and Wordfence, the bug sits in handling of the attributekey parameter and affects versions up to and including 1.2.0; Patchstack lists 1.2.1 as the first fixed version. The patch diff shows multiple raw SQL concatenations around session and attribute handling, which is exactly the kind of mistake that turns a public AJAX/chat workflow into database reads by strangers on the internet.

The vendor/CNA HIGH 7.5 baseline is broadly fair: this is pre-auth, remote, and against a web-facing WordPress plugin. But real-world risk is narrower than the label implies because the plugin only shows 6,000+ active installs, there is no KEV listing, and the supplied EPSS 0.00084 is very low. So this stays HIGH, but not because the average enterprise has a mass-breach crisis on its hands; it stays high because any site that actually runs this plugin is likely internet-exposed and the exploit path is short.

Why this verdict

• No attacker foothold required: unauthenticated remote SQLi means this is not post-initial-access and does not depend on phishing, VPN access, or stolen creds.
• Reachable population is small: WordPress.org shows only 6,000+ active installs, so the internet-wide blast radius is much smaller than the average WordPress SQLi headline.
• Threat signals are weak so far: no KEV and a very low EPSS (0.00084) are meaningful downward adjustments from the raw CVSS 7.5 baseline.
• Impact is serious but not maximal: the published vector is confidentiality-only; data theft can absolutely lead to takeover, but that requires a second step and is not guaranteed by the bug itself.
• Commodity defenses help: WAF rules, managed WordPress firewalls, and request filtering often disrupt common SQLi payloads, especially during mass scanning.

Why not higher?

This is not a KEV-listed bug, there is no authoritative sign of active exploitation in the reviewed sources, and the install base is modest. More importantly, the disclosed impact does not include direct unauthenticated code execution or database writes, so it lacks the instant-destruction profile that pushes plugin flaws into CRITICAL.

Why not lower?

Dropping this to MEDIUM would understate the lack of prerequisites. An internet attacker can hit a public WordPress workflow without auth, and successful SQLi against a CMS database can expose credentials, session material, and secrets that turn into full site compromise fast enough to matter.

1. Restrict public access to the chatbot path — If you cannot patch immediately, put the GeekyBot-facing routes behind IP allowlists, maintenance mode, or temporary disablement where business permits. For a HIGH finding, deploy this compensating control within 30 days if patch rollout is delayed, but sooner on any internet-facing site.
2. Enable or tighten WAF SQLi rules — Turn on managed SQL injection protections at the CDN, reverse proxy, or host firewall layer and verify WordPress-specific exceptions are not bypassing the chatbot flow. For a HIGH finding, tune and deploy these protections within 30 days.
3. Monitor WordPress and DB logs for extraction patterns — Hunt for repeated requests with SQL metacharacters, boolean/time-based probes, and suspicious bursts against WordPress AJAX/chat endpoints. Stand up alerting within 30 days so you have detection coverage while remediation proceeds.
4. Rotate sensitive secrets if compromise is suspected — If logs suggest probing or successful extraction, rotate WordPress admin passwords, session cookies, API keys, and any database credentials stored alongside the app. Do this immediately on suspected compromise, not on the normal patch cadence.

Run this on the target WordPress host or inside the web container, not from an auditor workstation. Invoke it as bash verify-geekybot-cve-2026-3456.sh /var/www/html/wp-content/plugins/geeky-bot; it needs only read access to the plugin directory and will report VULNERABLE, PATCHED, or UNKNOWN based on the installed version.

#!/usr/bin/env bash
# verify-geekybot-cve-2026-3456.sh
# Check whether installed GeekyBot plugin version is affected by CVE-2026-3456.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / unable to determine

set -u

TARGET_DIR="${1:-}"
FIXED_VERSION="1.2.1"
VULN_MAX="1.2.0"

if [[ -z "$TARGET_DIR" ]]; then
  echo "UNKNOWN - usage: $0 /path/to/wp-content/plugins/geeky-bot"
  exit 2
fi

if [[ ! -d "$TARGET_DIR" ]]; then
  echo "UNKNOWN - directory not found: $TARGET_DIR"
  exit 2
fi

version=""

# 1) Prefer readme.txt stable tag
if [[ -f "$TARGET_DIR/readme.txt" ]]; then
  version=$(grep -iE '^Stable tag:[[:space:]]*' "$TARGET_DIR/readme.txt" | head -n1 | sed -E 's/^Stable tag:[[:space:]]*//I' | tr -d '\r')
fi

# 2) Fall back to plugin header Version: in PHP files
if [[ -z "$version" ]]; then
  while IFS= read -r -d '' phpfile; do
    candidate=$(grep -iE '^\s*Version:[[:space:]]*' "$phpfile" | head -n1 | sed -E 's/^\s*Version:[[:space:]]*//I' | tr -d '\r')
    if [[ -n "$candidate" ]]; then
      version="$candidate"
      break
    fi
  done < <(find "$TARGET_DIR" -maxdepth 2 -type f -name '*.php' -print0 2>/dev/null)
fi

# 3) Normalize
version=$(echo "$version" | sed -E 's/^[[:space:]]+|[[:space:]]+$//g')

if [[ -z "$version" ]]; then
  echo "UNKNOWN - could not determine installed GeekyBot version"
  exit 2
fi

# version_le a b => true if a <= b
version_le() {
  local a="$1" b="$2"
  local first
  first=$(printf '%s\n%s\n' "$a" "$b" | sort -V | head -n1)
  [[ "$first" == "$a" ]]
}

if version_le "$version" "$VULN_MAX"; then
  echo "VULNERABLE - GeekyBot version $version is <= $VULN_MAX (fixed in $FIXED_VERSION)"
  exit 1
fi

if version_le "$FIXED_VERSION" "$version"; then
  echo "PATCHED - GeekyBot version $version is >= $FIXED_VERSION"
  exit 0
fi

# Defensive fallback for odd version strings
if [[ "$version" == "$FIXED_VERSION" ]]; then
  echo "PATCHED - GeekyBot version $version"
  exit 0
fi

echo "UNKNOWN - parsed version '$version' but comparison was inconclusive"
exit 2

Sources

1. NVD CVE-2026-3456
2. WordPress.org plugin page for GeekyBot
3. Patchstack advisory for GeekyBot <= 1.2.0 SQLi
4. Wordfence weekly vulnerability report (May 4-10, 2026)
5. Atomic Edge technical diff writeup for GeekyBot SQLi
6. CISA Known Exploited Vulnerabilities catalog
7. FIRST EPSS overview