CVE-2026-15048: GeekyBot < 1.2.8 - Unauthenticated Sensitive Information Exposure via Chat History
The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and timestamps.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15048?
CVE-2026-15048 has a risk score of 36, indicating a moderate level of severity.
How do I fix CVE-2026-15048?
To fix CVE-2026-15048, update the GeekyBot WordPress plugin to version 1.2.8 or later.
What kind of information is exposed in CVE-2026-15048?
CVE-2026-15048 allows the exposure of sensitive information including WordPress usernames, user IDs, and timestamps through chat history.
Which versions of GeekyBot are affected by CVE-2026-15048?
The vulnerability CVE-2026-15048 affects all versions of the GeekyBot WordPress plugin prior to 1.2.8.
Is user authentication required for CVE-2026-15048?
No, CVE-2026-15048 does not require user authentication, allowing unauthenticated users to access sensitive data.