The GeekyBot WordPress plugin, versions 1.2.0 and earlier, contains an unauthenticated SQL Injection flaw. The vulnerability allows an attacker to embed arbitrary SQL code into database queries sent to the plugin’s endpoints, potentially resulting in data exfiltration, modification, or deletion, and possibly a denial of service if the database is corrupted. The weakness is documented as CWE‑89, which describes improper input validation and inadequate query parameterization.

Any WordPress site that has the GeekyBot plugin installed with a version at or below 1.2.0, distributed by Ahmad:GeekyBot. Such sites are exposed regardless of the user role and do not require any privileged access to exploit the flaw.

The CVSS score of 9.3 marks this flaw as critical, but its EPSS score of less than 1% indicates a very low current likelihood of exploitation, and it is not listed in CISA’s KEV catalog. The vulnerability is exploitable via a crafted HTTP request to the plugin’s endpoint, requiring no authentication. The publicly accessible nature of the endpoint means that any visitor could potentially trigger the exploit, which presents a high‑risk attack vector for publicly hosted WordPress installations.