CVE-2026-15048 — GeekyBot < 1.2.8 - Unauthenticated Sensitive Information Exposure via Chat History
The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session …
Published: 2026-07-31 · CVSS: 7.5 · CVSS 3.1
The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and timestamps.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7