What is the CVSS score of CVE-2026-1359?

CVE-2026-1359 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Genolve are affected by CVE-2026-1359?

The Genolve AI WordPress plugin (versions through 5.0.5) contains a privilege escalation vulnerability allowing authenticated contributors to become administrators and seize full control of WordPress…

How to fix or mitigate CVE-2026-1359?

24 hours: Audit all WordPress instances for Genolve AI plugin versions ≤5.0.5; immediately disable user registration via Settings → General. 7 days: Remove Contributor-level access from non-essential users; disable the Genolve plugin entirely unless business-critical. 30 days: Monitor Genolve's advisory channels for patch release; switch to alternative image generation solutions with demonstrated security practices.

Genolve CVE-2026-1359

EUVD-2026-43166 HIGH

Incorrect Authorization (CWE-863)

2026-07-11 Wordfence

GHSA-89c5-rq9r-gpg5

WordPress Authentication Bypass Privilege Escalation Wordpress Plugin Genolve Genolve Ai Business Graphics Ai Images

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network handler with no capability check, exploitable by any Contributor account (PR:L), no user interaction; arbitrary option write yields full admin takeover (C/I/A High).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 08:46 vuln.today

CVE Published

Jul 11, 2026 - 07:47 cve.org

HIGH 8.8

DescriptionCVE.org

The Genolve - AI image AI video generation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the genolve_setOpt() function in all versions up to, and including, 5.0.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to update arbitrary WordPress options, including enabling user registration and setting the default role to administrator, resulting in privilege escalation.

Articles & Coverage 1

News 16 New WordPress Vulnerabilities - 16 High Severity Jul 12, 2026

AnalysisAI

Privilege escalation in the Genolve AI image and video generation plugin for WordPress (all versions through 5.0.5) lets authenticated users with Contributor-level access or above update arbitrary WordPress options because the genolve_setOpt() function performs no capability check. By enabling the users_can_register option and setting default_role to administrator, a low-privileged user can register a new administrator account and fully take over the site. Reported by Wordfence with a CVSS of 8.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is a WordPress plugin (server-side PHP) that exposes a settings handler, genolve_setOpt(), which persists plugin configuration through the WordPress options API (update_option). The root cause is CWE-863 (Incorrect Authorization): the handler authenticates the caller but never verifies a capability such as manage_options, nor restricts which option keys may be written, so any logged-in user at Contributor role or above can write to any row in the wp_options table. Because security-critical core settings such as users_can_register and default_role are stored in that same options table, an unrestricted option-write primitive converts directly into full administrative control. The CPE cpe:2.3:a:genolve:genolve_-_genolve_ai_business_graphics,_ai_images identifies the single affected plugin family.

RemediationAI

Upstream fix available (commit/changeset); released patched version not independently confirmed - the corrective change is recorded in the WordPress.org plugin repository (changeset 3460465 for the genolve-toolkit slug, https://plugins.trac.wordpress.org/changeset?reponame=&new=3460465%40genolve-toolkit&old=3432371%40genolve-toolkit), so update the Genolve plugin to the latest published version above 5.0.5 as soon as it is available and confirm the exact fixed release in the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/8f64361a-e5b5-4481-b25c-bdffeb80c198?source=cve). Until a tagged patched release is applied, reduce exposure by deactivating and removing the Genolve plugin (trade-off: loss of the AI image/video functionality), and by minimizing the number of Contributor-and-above accounts while disabling open self-registration for those roles (trade-off: friction for legitimate multi-author workflows). As a detective control, monitor wp_options for unexpected changes to users_can_register and default_role and alert on newly created administrator accounts so an exploitation attempt is caught even if patching lags.