The GeekyBot plugin for WordPress contains an unauthenticated SQL injection flaw in the 'attributekey' parameter. Because the input is not properly escaped or prepared, an attacker can inject arbitrary SQL statements. This flaw can be used to read sensitive information from the WordPress database, potentially exposing user data or site configuration. The vulnerability does not provide code‑execution capabilities but allows an attacker to obtain, tamper with, or delete database contents.

The vulnerability affects the GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero‑Prompt Content plugin, versions 1.2.0 and earlier, on any WordPress site that has the plugin installed and active. Sites running these versions are susceptible regardless of user role or network location.

The CVSS score of 7.5 signals a high‑impact issue. The lack of authentication and the straightforward injection path mean the flaw is readily exploitable from any external host. Although the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, the potential for data disclosure makes it a priority for operators, especially sites that store sensitive customer or business data.