Wordpress Plugin CVE-2026-2879

Multiple risk indicators suggest this is a genuine, actionable vulnerability requiring timely remediation. The CVSS v3.1 score of 5.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L reflects a network-accessible vulnerability with low attack complexity and low privilege requirement, resulting in limited confidentiality impact but notable integrity and availability damage. The lack of KEV (CISA Known Exploited Vulnerabilities) listing and unknown EPSS score do not diminish real-world priority; this is a classic IDOR affecting a widely-used WordPress plugin ecosystem. The attack requires legitimate authentication (PR:L) but no user interaction, making it fully automatable for any Author-level account holder. Using SSVC framework logic: exploitation is likely (low AC, clear technical impact to data integrity), the vulnerability is automatable (REST API exploitation), and technical impact is moderate (post data destruction/modification). In practical terms, any WordPress site using GetGenie 4.3.2 or earlier where multiple users have Author access or above faces a credible risk of content tampering or sabotage—particularly critical for multi-author blogs, news sites, or collaborative platforms.

An attacker with a legitimate Author account (e.g., a disgruntled contractor or compromised credential) logs into a WordPress REST API client or curl session and sends a POST request to the GetGenieChat endpoint with an arbitrary post ID belonging to an administrator. The create() method accepts the post ID without validation, calls wp_update_post() with attacker-controlled data (post_type='getgenie_chat', post_author=attacker_id), and overwrites the administrator's original post, destroying its content and reassigning ownership. Because no user interaction is required and the API is network-accessible to authenticated users, this can be automated to rapidly compromise multiple posts across a site.