# CVE-2026-57679: Ahmadgb GeekyBot SQL injection

Source: https://junglewise.ai/threats/cve-2026-57679-ahmadgb-geekybot-sql-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-57679 · Severity: critical · CVSS 9.3 · Published 2026-07-02

GeekyBot, a WordPress plugin, contains a critical security flaw that allows unauthorized individuals to access the website's database. An attacker could use this to steal sensitive customer information, modify site content, or disrupt operations. This vulnerability is particularly dangerous because it can be exploited remotely without needing any login credentials.

## Quick answers

**Is CVE-2026-57679 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57679 being exploited in the wild.

**How severe is CVE-2026-57679?** Critical severity, with a CVSS score of 9.3, published 2 July 2026.

**Which products and versions are affected?** Ahmadgb GeekyBot <= 1.2.5.

**Is there a fix for CVE-2026-57679?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-57679 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-57679?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

GeekyBot versions 1.2.5 and below are vulnerable to an unauthenticated SQL injection (CWE-89). The vulnerability exists due to improper neutralization of special elements used in SQL commands, allowing a remote attacker to send crafted queries to the database without authentication. With a CVSS score of 9.3, this flaw allows for high confidentiality impact, potentially leading to full database exfiltration. The issue is resolved in version 1.2.6.

## Affected products

- Ahmadgb GeekyBot <= 1.2.5

## Timeline

- 2026-06-04: other: Reported by researcher daroo
- 2026-06-29: advisory: Patchstack advisory published
- 2026-07-02: disclosed: CVE published to NVD

## References

- [https://patchstack.com/database/wordpress/plugin/geeky-bot/vulnerability/wordpress-geekybot-plugin-1-2-5-sql-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/geeky-bot/vulnerability/wordpress-geekybot-plugin-1-2-5-sql-injection-vulnerability?_s_id=cve)