Executive brief
The Geeky Bot plugin for WordPress, which provides chat widget functionality, contains a security flaw that allows unauthorized individuals to view chat session metadata. An attacker can access information such as WordPress usernames, user IDs, and timestamps of when chats occurred. While the actual content of the chat messages remains protected, this leak could be used by malicious actors to map out user accounts on the website for further targeted attacks.
Technical details
The Geeky Bot plugin fails to implement proper authorization checks or nonce verification on the 'geekybot_ajax' AJAX action when the 'task' parameter is set to 'getNextChatHistorySessions'. An unauthenticated remote attacker can send a POST request to wp-admin/admin-ajax.php to trigger this action. By manipulating the 'offset' parameter, an attacker can enumerate and retrieve HTML blocks containing session metadata for all chat participants, including display names, WordPress user IDs, and session timestamps. This vulnerability is classified as sensitive information disclosure (CWE-200). The issue is resolved in version 1.2.8.
Affected products
- Geeky Bot Geeky Bot < 1.2.8
Timeline
- 2026-07-13: disclosed
- 2026-07-13: patched: Fixed in version 1.2.8
- 2026-07-31: advisory