The GeekyBot plugin for WordPress is affected by a critical missing authorization flaw in versions up to and including 1.2.2. An unauthenticated user can trigger the 'geekybot_frontendajax' nopriv AJAX route, which accepts attacker‑controlled parameters to dispatch a model or function. The attacker can then invoke a plugin installer helper that downloads and unzips arbitrary ZIP files into the wp-content/plugins directory. This mechanism allows the attacker to install malicious plugins and ultimately execute remote code on the host server.

Impacting the ahmadgb:GeekyBot plugin used for AI copilot, chatbot, WooCommerce lead generation, and zero‑prompt content. Any WordPress site running GeekyBot 1.2.2 or earlier is vulnerable.

With a CVSS score of 9.8 the vulnerability is considered critical. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Because the flaw requires no authentication and is driven by a simple AJAX request that accepts user input, the attack vector is likely network‑based and can be exploited by any internet‑connected attacker. Successful exploitation would give the attacker full remote code execution privileges on the server, granting complete control over the affected site.