Security Alert Summary
The GenieWords WordPress plugin versions 1.5.27 through 1.5.34 contains missing authorization checks on some REST API and AJAX actions and decodes stored values before printing them. This allows unauthenticated users to overwrite plugin configuration and inject arbitrary web scripts that execute on every front-end page.
CVE Details
- CVE ID: CVE-2026-74933
- Affected plugin: GenieWords (WordPress plugin)
- Affected versions: 1.5.27 through 1.5.34
- Published: September 13, 2026, 9:17:01 PM UTC
- Last modified: September 14, 2026, 1:18:45 PM UTC
- CVSS v3.1: Base score 8.8, severity HIGH, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Authentication / Privileges / User interaction: No privileges required (PR:N). Unauthenticated access is possible; user interaction is required (UI:R).
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- CWE: CWE-862 (Missing Authorization)
Technical Details
According to the vulnerability description, the plugin does not perform authorization checks on some of its REST API and AJAX actions. In addition, the plugin decodes stored values before printing them to pages. Together these weaknesses allow unauthenticated attackers to overwrite the plugin’s configuration and inject arbitrary web scripts into stored data that are then rendered and executed on every front-end page.
The issue exists because expected authorization checks are missing for certain endpoints/actions, and output is rendered after decoding without sufficient output encoding or sanitization. The vulnerability is a stored cross-site scripting-like condition that results from the combination of improper access control and unsafe decoding/output of stored values.
How This Could Impact Your Website
On a multi-user WordPress site, an unauthenticated attacker could exploit the missing authorization checks to change the GenieWords plugin configuration. For example, an attacker could inject scripts that run in visitors browsers on pages that load the plugin output. This could be used to harvest email addresses, capture form data, or perform browser-based actions that enable targeted phishing against site staff or external contributors.
A likely scenario involves a site owner and internal staff who rely on user-facing content and a third-party contributor who uploads or manages content. If the plugin output is injected with scripts, regular visitors and logged-in users could be exposed to malicious content. This increases the risk of targeted social engineering or credential harvesting based on information visible on the site or collected via injected scripts.
If you?re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other low-privilege roles that may be able to interact with plugin endpoints.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual behavior or unexpected changes to plugin configuration or content.
If you?d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
