The Geeky Bot WordPress plugin versions prior to 1.2.8 contain a vulnerability where an AJAX action does not enforce authorization checks. This flaw permits unauthenticated attackers to retrieve chat-history session metadata, exposing WordPress usernames, user IDs, and timestamps. The vulnerability is classified under CWE-200 (Information Exposure) and has a CVSS 3.1 base score of 7.5, reflecting high severity due to the ease of exploitation (network accessible, no privileges required, no user interaction) and the confidentiality impact.

An attacker can obtain sensitive user metadata including usernames and user IDs without authentication. This exposure can facilitate further attacks such as user enumeration or targeted social engineering. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users of Geeky Bot plugin should upgrade to version 1.2.8 or later once a fix is officially released. Until then, consider restricting access to the vulnerable AJAX endpoint or disabling the plugin if feasible.