The Geeky Bot plugin for WordPress versions up to and including 1.2.2 contains a missing authorization vulnerability. This flaw allows unauthenticated attackers to exploit a no-privilege AJAX route to dispatch arbitrary functions, leading to the download and extraction of attacker-supplied ZIP files into the plugin directory. This enables arbitrary plugin installation and remote code execution on the affected WordPress site.