CVE-2026-2879

Summary

The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2. This is due to missing validation on the id parameter in the create() method of the GetGenieChat REST API endpoint. The method accepts a user-controlled post ID and, when a post with that ID exists, calls wp_update_post() without verifying that the current user owns the post or that the post is of the expected getgenie_chat type. This makes it possible for authenticated attackers, with Author-level access and above, to overwrite arbitrary posts owned by any user — including Administrators — effectively destroying the original content by changing its post_type to getgenie_chat and reassigning post_author to the attacker.

Affected Software

VendorProductVersion RangeStatus
roxnorGetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools0 <= 4.3.2affected

Weaknesses

  • CWE-639: CWE-639 Authorization Bypass Through User-Controlled Key

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References