CVE-2026-15048

The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and timestamps.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.26% chance of exploitation in the next 30 days, 17th percentile

Published

2026-07-31

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/881d1548-e6c3-4093-ab8c-dc3a9fcccc34/

References

• CVE Record
• NVD entry

Related

• CVE-2026-15047
• CVE-2026-15049
• CVE-2026-15046
• CVE-2026-1505
• CVE-2026-15045
• CVE-2026-15054