Security Alert Summary
The GetGenie plugin for WordPress contains an Insecure Direct Object Reference (IDOR) in its REST API which, in affected versions, allows authenticated users with Author-level access or higher to overwrite arbitrary posts owned by other users. The flaw is caused by missing validation of a user-supplied id parameter in the create() method of the GetGenieChat REST API endpoint, which leads to calls to wp_update_post() without verifying post ownership or post type.
CVE Details
- CVE ID: CVE-2026-2879
- Affected component: GetGenie plugin for WordPress (GetGenieChat REST API)
- Affected versions: All versions up to, and including, 4.3.2
- Published date: March 13, 2026 at 7:54:34 PM (timestamp from CVE entry)
- Last modified date: March 13, 2026 at 7:54:34 PM (timestamp from CVE entry)
- CVSS v3.1: Base Score 5.4, Severity MEDIUM, Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - Authentication / privileges / user interaction: Requires authentication. Privileges required: Low (Author-level access and above as noted in the description). User interaction: None.
- Primary impact:
- Confidentiality: None
- Integrity: Low (ability to overwrite or alter post content and attributes)
- Availability: Low (destruction or unintended modification of content)
- Weakness (CWE): CWE-639 (Authorization Bypass Through User-Controlled Key)
Technical Details
The vulnerability is an Insecure Direct Object Reference caused by missing validation of the id parameter in the create() method of the GetGenieChat REST API endpoint. The method accepts a user-controlled post ID and, when a post with that ID exists, calls wp_update_post() without verifying that the current user is the post owner or that the post is of the expected getgenie_chat type.
Because the code does not check post ownership or post type before calling wp_update_post(), an authenticated user with sufficient privileges (Author-level and above) can supply an arbitrary post ID, causing the plugin to change the target post’s post_type to getgenie_chat and reassign post_author to the attacker. This overwrites or effectively destroys the original content for that post and changes its attributes.
How This Could Impact Your Website
In a multi-user WordPress site, this vulnerability could allow an authenticated contributor or contractor with Author-level access to overwrite posts created by other users, including posts originally authored by administrators. For example, an internal staff member with Author access could unintentionally or maliciously cause published articles or pages to be converted to the getgenie_chat post type and have their authorship reassigned, resulting in lost or altered content and editorial confusion.
Practical consequences include loss of original content, broken display or functionality for the affected posts, and administrative overhead to restore content from backups or revision history. While the CVSS data indicates no direct confidentiality impact, the integrity changes (altered content and authorship) can disrupt workflows and trust in published material. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (A fixed version is not specified in the CVE entry.)
- Review and reduce unnecessary user roles and privileges, particularly Author-level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and post changes for unusual behavior; check recent post updates and authorship changes.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/getgenie/tags/4.3.2/app/Api/GetGenieChat.php#L60
- https://plugins.trac.wordpress.org/browser/getgenie/tags/4.3.2/app/Api/GetGenieChat.php#L91
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3479838%40getgenie%2Ftrunk&old=3446466%40getgenie%2Ftrunk&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8030c334-458a-4d21-9a64-3f5df715ba97?source=cve
