The vulnerability in Geeky Bot allows any unauthenticated visitor to send an AJAX request that returns chat-history session metadata. The response includes WordPress usernames, user IDs, and timestamps, enabling attackers to map user identities and potentially target accounts with phishing or other social engineering attacks. This constitutes a direct exposure of sensitive data that could be leveraged in downstream attack scenarios.

Any installation of the Geeky Bot WordPress plugin with a version prior to 1.2.8 is affected. The publisher was identified as Unknown:Geeky Bot, and the vulnerability is specific to the AJAX endpoint that delivers chat history. No specific operating system or platform distinctions are listed, so all environments running the plugin before the noted version are impacted.

Because the plugin performs no authorization check on the AJAX action, the attack path requires only that an unauthenticated user crafts a correct request. The EPSS score is <1%, indicating a low likelihood of exploitation, but the sensitivity of the exposed data, coupled with a CVSS score of 7.5, signifies a high severity. The vulnerability is not listed in the CISA KEV catalog, but it remains a serious privacy concern for site owners.