Geeky Bot WordPress Plugin Missing Authorization Vulnerability Allowing Unauthenticated Arbitrary Plugin Installation and Remote Code Execution

A vulnerability exists in the Geeky Bot plugin for WordPress, specifically in versions through 1.2.2, due to a missing authorization in a nopriv AJAX route. This flaw allows unauthenticated attackers to dispatch model/function calls that reach a plugin installer helper. The helper downloads and unzips ZIP files supplied by the attacker into the wp-content/plugins/ directory. As a result, this vulnerability enables unauthorized users to install arbitrary plugins, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability allows for unauthorized plugin installation, which could be used to execute malicious code remotely, depending on the functionality of the installed plugin.

Remediation

Users are advised to update the Geeky Bot WordPress plugin to version 1.2.3 or a later patched version.