CVE-2026-15048

The Geeky Bot WordPress plugin prior to version 1.2.8 is vulnerable due to a lack of authorization checks on specific AJAX actions, enabling unauthenticated users to access sensitive chat-history session metadata, including WordPress usernames and user IDs. This exposure can lead to unauthorized information disclosure and potential account compromise. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate the risk.