Genolve CVE-2026-1359

Exploitation requires an authenticated WordPress account at Contributor role or higher on the target site (per CVSS PR:L) and requires the vulnerable Genolve plugin version (≤ 5.0.5) to be installed and active. No victim user interaction is needed (UI:N) and the request is network-reachable (AV:N). The concrete abuse path relies on WordPress core settings the flaw lets the attacker toggle: enabling users_can_register and setting default_role to administrator. Limiting factors: sites that do not run this plugin, or that issue no Contributor-or-higher accounts to untrusted parties, are not exposed; because the attacker needs a foothold account first, this is a privilege escalation rather than a fully unauthenticated compromise.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High) is internally consistent with the description: network-reachable, low complexity, no user interaction, requiring only low privileges (a Contributor account), with High confidentiality/integrity/availability impact reflecting full site takeover. Real-world risk hinges on the PR:L prerequisite - the attacker must already hold a Contributor-or-higher account, which is common on multi-author blogs, membership, or guest-post sites but a real barrier on single-admin installs. No EPSS score, KEV listing, or SSVC data was provided, and no public proof-of-concept is referenced, so this must NOT be treated as actively exploited; it is a high-impact, low-complexity privilege escalation whose priority scales with how many low-trust accounts a site issues. The corrective change is already committed to the plugin source repository (WordPress.org trac changeset), which typically shortens the window before opportunistic scanning of unpatched installs.

An attacker holding a Contributor account (for example on a site that accepts guest authors) sends an authenticated request to the plugin's genolve_setOpt() handler and writes users_can_register=1 and default_role=administrator. They then use the standard WordPress registration page to create a self-service account, which is automatically granted administrator privileges, yielding full control of the site. No public proof-of-concept is referenced and no user interaction is required beyond the attacker's own authenticated request.