CVE-2026-3456
Published: 05 May 2026
Summary
CVE-2026-3456 is a high-severity SQL Injection (CWE-89) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as LLM Application Platforms; in the Privacy and Disclosure risk domain.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-3456 is a SQL injection vulnerability (CWE-89) affecting the GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress in versions up to and including 1.2.0. The issue stems from insufficient escaping of the user-supplied 'attributekey' parameter and lack of sufficient preparation in the existing SQL query, allowing attackers to append additional SQL queries.
Unauthenticated attackers can exploit this vulnerability remotely with low attack complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Successful exploitation enables extraction of sensitive information from the database.
Mitigation details are available in the plugin's patch via the WordPress trac changeset at https://plugins.trac.wordpress.org/changeset/3474168/geeky-bot and the Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/4c716fd3-6297-4b3a-a796-65f68f2986cf?source=cve, which cover remediation steps for affected installations.
The plugin's focus on AI content generation introduces relevance to AI/ML-adjacent WordPress deployments, though no real-world exploitation has been reported in the provided details.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-27175
Vulnerability details
The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to SQL Injection via the 'attributekey' parameter in versions up to, and including, 1.2.0 due to insufficient escaping on the user supplied parameter…
more
and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- CWE(s)
AI Security AnalysisAI
- AI Category
- LLM Application Platforms
- Risk Domain
- Privacy and Disclosure
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing WordPress plugin enables remote exploitation of web apps (T1190) and direct DB data extraction (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation and sanitization of user-supplied parameters like 'attributekey' before incorporation into SQL queries.
Mitigates the vulnerability by mandating timely identification, reporting, and correction of the specific SQL injection flaw through application of the available plugin patch.
Detects the SQL injection vulnerability through regular scanning and ensures remediation to prevent exploitation in WordPress plugin deployments.