CVE-2026-15048

A Sensitive Information Exposure vulnerability exists in the WordPress GeekyBot plugin in versions prior to 1.2.8. The plugin does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and session timestamps.

This vulnerability is classified under OWASP A1: Broken Access Control / CWE-200 (Information Exposure) and exposes user accounts and session data to unauthenticated attackers.

GeekyBot is an AI chatbot plugin for WordPress sites. In versions prior to 1.2.8, an unprotected AJAX endpoint exposes chat session history queries without verifying whether the requesting client has permission or ownership of the session.

An unauthenticated attacker can send crafted HTTP requests to the AJAX endpoint to leak user IDs, registered WordPress usernames, and chat timestamps.

Attack vector: Unauthenticated HTTP POST request to the unprotected AJAX action.

• Unauthenticated leakage of WordPress usernames and user IDs
• Exposure of chat session metadata and user interaction history
• Username harvesting enabling targeted credential brute-force attacks

Update GeekyBot to version 1.2.8 or later. The patched version introduces proper authorization verification on chat-history AJAX endpoints.