{"data":{"id":"c8ab2f49-14a8-4eed-8cdf-9f22a39147af","title":"CVE-2026-3456: The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to…","summary":"CVE-2026-3456 affects The GeekyBot WordPress plugin, which generates AI content and chatbots, in versions up to and including 1.2.0. The 'attributekey' parameter lacks sufficient escaping and the existing SQL query is not properly prepared, enabling SQL Injection. Unauthenticated attackers can append additional SQL queries to existing ones and extract sensitive information from the database.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-3456","publishedAt":"2026-05-05T04:16:16.790Z","cveId":"CVE-2026-3456","cweIds":["CWE-89"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["GeekyBot"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"GeekyBot WordPress plugin SQL injection via attributekey parameter","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00278,"epssCheckedAt":"2026-11-10T00:11:23.264Z","kevDateAdded":null,"advisoryAliases":["GHSA-4w7g-g36x-7pgv"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T06:12:13.610Z","patchAvailable":null,"disclosureDate":"2026-05-05T04:16:16.790Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-66"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}