{"metadata": {"vulnerability": "CVE-2026-5294", "count": 21, "kinds": {"milestone": 4, "sighting": 7, "kev": 0, "other": 10}, "linked_omitted": 0}, "data": [{"timestamp": "2026-03-31T22:56:16.553Z", "date_only": false, "value": "2026-03-31T22:56:16.553Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-5294", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-03-31T23:12:10Z", "date_only": false, "value": "2026-03-31T23:12:10.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-5294", "field": "containers.cna.timeline.0.time", "text": "Vendor Notified"}, {"timestamp": "2026-05-04T15:26:29Z", "date_only": false, "value": "2026-05-04T15:26:29.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-5294", "field": "containers.cna.timeline.1.time", "text": "Disclosed"}, {"timestamp": "2026-05-05T03:37:37.441Z", "date_only": false, "value": "2026-05-05T03:37:37.441Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-5294", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-05-05T03:37:37.441Z", "date_only": false, "value": "2026-05-05T03:37:37.441Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-5294", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-05-05T04:16:19Z", "date_only": false, "value": "2026-05-05T04:16:19Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-G79M-G3FV-4RQ9", "record": "GHSA-G79M-G3FV-4RQ9", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-05-05T04:16:19.470Z", "date_only": false, "value": "2026-05-05T04:16:19.470", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-5294", "record": "FKIE_CVE-2026-5294", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-05-05T04:30:26.688Z", "date_only": false, "value": "2026-05-05T04:30:26.688484Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/116520086781199288", "record": "cve-2026-5294", "field": "creation_timestamp", "uuid": "af4181a2-ce64-4f81-add2-3350fca2afa6", "content": "\ud83d\udea8 CRITICAL: CVE-2026-5294 in Geeky Bot WP plugin (\u22641.2.2) allows unauthenticated RCE by installing arbitrary plugins via an exposed AJAX endpoint. Disable or remove plugin & monitor for patches. https://radar.offseq.com/threat/cve-2026-5294-cwe-862-missing-authorization-in-ahm-a69c64e2 #OffSeq #WordPress #Vuln #InfoSec", "url": "https://infosec.exchange/users/offseq/statuses/116520086781199288"}, {"timestamp": "2026-05-05T04:30:28.329Z", "date_only": false, "value": "2026-05-05T04:30:28.329608Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3ml3e2ul6oy2l", "record": "cve-2026-5294", "field": "creation_timestamp", "uuid": "d4e809ea-3a5f-4dac-a168-53c7e4625eb6", "content": "Geeky Bot WP plugin (\u22641.2.2) has a CRITICAL flaw: unauth attackers can install plugins & run code. Disable or remove plugin ASAP and watch for patches. https://radar.offseq.com/threat/cve-2026-5294-cwe-862-missing-authorization-in-ahm-a69c64e2 #OffSeq #WordPress #Security", "url": "https://bsky.app/profile/offseq.bsky.social/post/3ml3e2ul6oy2l"}, {"timestamp": "2026-05-05T06:24:42.574Z", "date_only": false, "value": "2026-05-05T06:24:42.574733Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ml3kh5qhtd2e", "record": "CVE-2026-5294", "field": "creation_timestamp", "uuid": "9a3a2636-2df0-461c-9de8-e2d52d00d0f2", "content": "CVE-2026-5294 - GeekyBot\nCVE ID : CVE-2026-5294\n \n Published : May 5, 2026, 4:16 a.m. | 2\u00a0hours, 4\u00a0minutes ago\n \n Description : The Geeky Bot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.2.2. This is due to a nopriv AJAX route...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3ml3kh5qhtd2e"}, {"timestamp": "2026-05-05T06:31:05Z", "date_only": false, "value": "2026-05-05T06:31:05Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-G79M-G3FV-4RQ9", "record": "GHSA-G79M-G3FV-4RQ9", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-05-05T06:31:05Z", "date_only": false, "value": "2026-05-05T06:31:05Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-G79M-G3FV-4RQ9", "record": "GHSA-G79M-G3FV-4RQ9", "field": "modified", "linked_record": true}, {"timestamp": "2026-05-05T19:19:22.357Z", "date_only": false, "value": "2026-05-05T19:19:22.357081Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ml4vqdvtin2q", "record": "CVE-2026-5294", "field": "creation_timestamp", "uuid": "24d9869c-0c43-42d1-9795-251b6afa5b60", "content": "\ud83d\udd34 CVE-2026-5294 - Critical (9.8)\n\nThe Geeky Bot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-5294/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ml4vqdvtin2q"}, {"timestamp": "2026-05-06T12:31:13.223Z", "date_only": false, "value": "2026-05-06T12:31:13.223079Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-5294", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-05-06T12:31:13.223Z", "date_only": false, "value": "2026-05-06T12:31:13.223079Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-5294", "record": "FKIE_CVE-2026-5294", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-05-06T12:31:22.424Z", "date_only": false, "value": "2026-05-06T12:31:22.424Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-5294", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-05-06T12:31:22.424Z", "date_only": false, "value": "2026-05-06T12:31:22.424Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-5294", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-17T10:58:46.310Z", "date_only": false, "value": "2026-06-17T10:58:46.310", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-5294", "record": "FKIE_CVE-2026-5294", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-09-12T10:00:16.115Z", "date_only": false, "value": "2026-09-12T10:00:16.115535Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/shimiscyberworld/1233", "record": "CVE-2026-5294", "field": "creation_timestamp", "uuid": "9434f68c-dc25-401b-a4af-51c1466003a4", "content": "\ud83d\udee1\ufe0f SCW \u2502 Daily Vulnerability Digest\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83d\udcc5 2026-05-05\n\n\ud83d\udcca 52 vulnerabilities detected today \u2014 14 \ud83d\udd34 Critical, 38 \ud83d\udd34 High\n\n\ud83d\udd34 CRITICAL\n  \u2022 CVE-2026-7411 (10) \u2014 Eclipse BaSyx RCE: Critical Path Traversal in Server SDK\n  \u2022 CVE-2026-5722 (9.8) \u2014 MoreConvert Pro WordPress Plugin Critical Authentication\u2026\n  \u2022 CVE-2025-13618 (9.8) \u2014 CVE-2025-13618: WordPress Mentoring Plugin Allows Admin\u2026\n  \u2022 CVE-2026-5294 (9.8) \u2014 CVE-2026-5294: Critical RCE in Geeky Bot WordPress Plugin\n  \u2022 CVE-2026-7823 (9.8) \u2014 CVE-2026-7823: Critical Command Injection in Totolink\u2026\n  \u2022 CVE-2023-54342 (9.8) \u2014 Eclipse Equinox OSGi RCE: Critical Vulnerability Allows\u2026\n  \u2022 CVE-2023-54344 (9.8) \u2014 Eclipse Equinox OSGi RCE: Critical Vulnerability Exposes\u2026\n  \u2022 CVE-2026-7834 (9.8) \u2014 CVE-2026-7834: Critical Stack-Based Buffer Overflow in EFM\u2026\n  \u2026 and 6 more\n\n\ud83d\udd34 HIGH\n  \u2022 CVE-2023-54345 (8.8) \u2014 Frappe Framework ERPNext Sandbox Escape Allows RCE via\u2026\n  \u2022 CVE-2023-54348 (8.8) \u2014 ERPGo SaaS 3.9 CSV Injection Allows RCE via Vendor Fields\n  \u2022 CVE-2026-42434 (8.8) \u2014 OpenClaw Sandbox Escape (CVE-2026-42434) Allows Remote\u2026\n  \u2022 CVE-2026-42435 (8.8) \u2014 OpenClaw CVE-2026-42435: Shell Wrapper Vulnerability Allows\u2026\n  \u2022 CVE-2026-43530 (8.8) \u2014 OpenClaw Vulnerability CVE-2026-43530 Undermines Exec\u2026\n  \u2022 CVE-2026-43569 (8.8) \u2014 OpenClaw Authentication Bypass (CVE-2026-43569) Poses High\u2026\n  \u2022 CVE-2026-43571 (8.8) \u2014 CVE-2026-43571: OpenClaw Plugin Trust Bypass Opens Attack\u2026\n  \u2022 CVE-2026-6261 (8.8) \u2014 Betheme WordPress Arbitrary File Upload RCE (CVE-2026-6261)\n  \u2022 CVE-2026-7855 (8.8) \u2014 D-Link DI-8100 Buffer Overflow - CVE-2026-7855 Public\u2026\n  \u2022 CVE-2026-35228 (8.7) \u2014 Oracle MCP Server Helper Tool Vulnerability Allows\u2026\n  \u2026 and 28 more\n\n\ud83d\udcd6 View all vulnerabilities \u2192\n\n\ud83c\udfaf Need SIEM rules for these threats?\nGenerate detection rules for Splunk, Sentinel, QRadar & more \u2014 tailored per breach\nOpen /detect in Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "url": "https://t.me/shimiscyberworld/1233"}, {"timestamp": "2026-09-12T10:00:16.668Z", "date_only": false, "value": "2026-09-12T10:00:16.668959Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/shimiscyberworld/1203", "record": "CVE-2026-5294", "field": "creation_timestamp", "uuid": "063e1580-2601-45b6-840d-a9bf94a0a8e9", "content": "\ud83d\udee1\ufe0f SCW \u2502 Critical Vulnerability\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u26a0\ufe0f CVE-2026-5294 \u2014 CVSS 9.8\nCVE-2026-5294: Critical RCE in Geeky Bot WordPress Plugin\n\nCVE-2026-5294 \u2014 The Geeky Bot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.2.2. This is due to a nopriv AJAX route allowing attac\n\n\ud83d\udd34 Critical\n\n#cve  #critical  #high_severity\n\n\ud83d\udcd6 Full analysis + IOCs \u2192\n\ud83c\udfaf Type /detect cve-2026-5294 in the bot\nOpen Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "url": "https://t.me/shimiscyberworld/1203"}, {"timestamp": "2026-09-29T12:47:16.333Z", "date_only": false, "value": "2026-09-29T12:47:16.333734Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cR0w/statuses/117354399908091855", "record": "CVE-2026-5294", "field": "creation_timestamp", "uuid": "d9910ca1-a84a-43cd-8496-4a504864cd31", "content": "RE: https://mastodon.bsd.cafe/@stefano/117354014226641780\nSure glad I moved my main workstation to Debian. :brdAngry: \nCVE-2024-5256CVE-2024-5809CVE-2025-2181CVE-2025-2210CVE-2025-2212CVE-2025-3820CVE-2025-3823CVE-2025-3862CVE-2025-3983CVE-2025-3992CVE-2025-4006CVE-2025-4010CVE-2025-4013CVE-2025-4016CVE-2026-10007CVE-2026-100079CVE-2026-2313CVE-2026-4319CVE-2026-4334CVE-2026-4596CVE-2026-5294CVE-2026-5301CVE-2026-5308CVE-2026-5310CVE-2026-5311CVE-2026-5325CVE-2026-5331CVE-2026-6405CVE-2026-6407CVE-2026-6408CVE-2026-6421CVE-2026-6828CVE-2026-6830CVE-2026-6833CVE-2026-7233CVE-2026-7240CVE-2026-7241CVE-2026-7243CVE-2026-7248CVE-2026-7249CVE-2026-7425CVE-2026-7426CVE-2026-7428CVE-2026-7429CVE-2026-7433CVE-2026-7449CVE-2026-7452CVE-2026-7473CVE-2026-7475CVE-2026-8052CVE-2026-8067CVE-2026-8075CVE-2026-8076CVE-2026-8077CVE-2026-8078CVE-2026-8079CVE-2026-8080CVE-2026-8082CVE-2026-8083CVE-2026-8084CVE-2026-8085CVE-2026-8086CVE-2026-8087CVE-2026-8091CVE-2026-8092CVE-2026-8093CVE-2026-8094CVE-2026-8095CVE-2026-8096CVE-2026-8097CVE-2026-8098CVE-2026-8099CVE-2026-8100CVE-2026-8101CVE-2026-8943CVE-2026-8944CVE-2026-8945CVE-2026-8946CVE-2026-8947CVE-2026-8948CVE-2026-8949CVE-2026-8950CVE-2026-8951CVE-2026-8952CVE-2026-8953CVE-2026-8954CVE-2026-8955CVE-2026-8956CVE-2026-8957CVE-2026-8958CVE-2026-8959CVE-2026-8960CVE-2026-8961CVE-2026-8962CVE-2026-8963CVE-2026-8964CVE-2026-8965CVE-2026-8966CVE-2026-8967CVE-2026-8968CVE-2026-8969CVE-2026-8970CVE-2026-8971CVE-2026-8972CVE-2026-8973CVE-2026-8974CVE-2026-8975CVE-2026-8976CVE-2026-8977CVE-2026-8978CVE-2026-8979CVE-2026-8980CVE-2026-8981CVE-2026-8982CVE-2026-8983CVE-2026-8984CVE-2026-8985CVE-2026-8986CVE-2026-8987CVE-2026-8988CVE-2026-8989CVE-2026-8990CVE-2026-8992CVE-2026-8993CVE-2026-8994CVE-2026-8995CVE-2026-8996CVE-2026-8997CVE-2026-8998CVE-2026-8999CVE-2026-9000CVE-2026-9001CVE-2026-9002CVE-2026-9003CVE-2026-9004CVE-2026-9005CVE-2026-9006CVE-2026-9007CVE-2026-9008CVE-2026-9009CVE-2026-9010CVE-2026-9011CVE-2026-9012CVE-2026-9013CVE-2026-9014CVE-2026-9015CVE-2026-9016CVE-2026-9017CVE-2026-9018CVE-2026-9019CVE-2026-9020CVE-2026-9021CVE-2026-9022CVE-2026-9023CVE-2026-9024CVE-2026-9025CVE-2026-9026CVE-2026-9027CVE-2026-9028CVE-2026-9029CVE-2026-9030CVE-2026-9031CVE-2026-9032CVE-2026-9033CVE-2026-9034CVE-2026-9035CVE-2026-9036CVE-2026-9037CVE-2026-9038CVE-2026-9039CVE-2026-9040CVE-2026-9041CVE-2026-9042CVE-2026-9043CVE-2026-9247CVE-2026-9248CVE-2026-9249CVE-2026-9250CVE-2026-9251CVE-2026-9252CVE-2026-9303CVE-2026-9304CVE-2026-9305CVE-2026-9306CVE-2026-9307CVE-2026-9308CVE-2026-9309CVE-2026-9310CVE-2026-9311CVE-2026-9312CVE-2026-9313CVE-2026-9314CVE-2026-9315CVE-2026-9316CVE-2026-9317CVE-2026-9318CVE-2026-9319CVE-2026-9320CVE-2026-9321CVE-2026-9322CVE-2026-9323CVE-2026-9324CVE-2026-9325CVE-2026-9326CVE-2026-9327CVE-2026-9328CVE-2026-9378CVE-2026-9379CVE-2026-9380CVE-2026-9381CVE-2026-9382CVE-2026-9383CVE-2026-9740CVE-2026-9741CVE-2026-9742CVE-2026-9743CVE-2026-9744CVE-2026-9745CVE-2026-9747CVE-2026-9748CVE-2026-9749CVE-2026-9750CVE-2026-9751CVE-2026-9752CVE-2026-9753CVE-2026-9754CVE-2026-9755CVE-2026-9756CVE-2026-9757CVE-2026-9758CVE-2026-9759CVE-2026-9760CVE-2026-9761CVE-2026-9789CVE-2026-9790CVE-2026-9791CVE-2026-9792CVE-2026-9793CVE-2026-9794CVE-2026-9795CVE-2026-9796CVE-2026-9797CVE-2026-9798CVE-2026-9799CVE-2026-9800CVE-2026-9801CVE-2026-9802CVE-2026-9803CVE-2026-9804CVE-2026-9805CVE-2026-9806CVE-2026-9807CVE-2026-9808CVE-2026-9809CVE-2026-9810CVE-2026-9811CVE-2026-9812CVE-2026-9813CVE-2026-9814CVE-2026-9815CVE-2026-9816", "url": "https://infosec.exchange/users/cR0w/statuses/117354399908091855"}], "metrics": {"as_of": "2026-11-11T15:56:46.385Z", "anchors": {"origin": {"timestamp": "2026-05-05T03:37:37.441Z", "date_only": false, "value": "2026-05-05T03:37:37.441Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-5294", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-05-05T03:37:37.441Z", "date_only": false, "value": "2026-05-05T03:37:37.441Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-5294", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 16460348.944189, "hours": 4572.319151163611, "days": 190.51329796515049, "min_seconds": 16460348.944189, "max_seconds": 16460348.944189, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-05-05T03:37:37.441Z", "date_only": false, "value": "2026-05-05T03:37:37.441Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-5294", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-11T15:56:46.385Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}