CVE-2026-40772: WordPress GeekyBot plugin <= 1.2.2 - Arbitrary File Upload vulnerability

Synopsis

An arbitrary file upload vulnerability exists in the GeekyBot WordPress plugin (versions 1.2.2 and below). The flaw is reachable over the network with no authentication required and no user interaction needed, making it trivially exploitable from the open internet. Successful exploitation allows an attacker to upload and execute arbitrary files on the server, enabling full remote code execution, data theft, and complete compromise of the affected host. No fix has been published; HarborGuard tracks the advisory and will make a patched rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker can reach it from the open internet without needing any prior foothold on the host.

• AuthenticationNot required

  No account or credentials of any kind are needed; the file upload endpoint accepts requests from unauthenticated users.

• Victim interactionNot required

  The attack is fully automated and requires no action from any user or administrator on the target site.

• Attack complexityDetail

  Exploitation is reliable and condition-free: no race conditions, memory layout dependencies, or other environmental factors stand between the attacker and a successful upload.

Blast Radius

• Attacker uploads a web shell or malicious PHP file and achieves remote code execution on the underlying server.
• Attacker reads sensitive files from the server, including WordPress configuration files containing database credentials.
• Attacker modifies or deletes site content, database records, and application files.
• Attacker pivots from the compromised host to other services or networks accessible from the server, given the CVSS Scope:Changed rating indicating impact beyond the vulnerable component.