What is the CVSS score of CVE-2026-2879?

CVE-2026-2879 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-2879?

Organizations using for WordPress is vulnerable to Insecure Direct Object Reference in all should be aware of moderate risk from CVE-2026-2879, a IDOR vulnerability rated CVSS 5.4.

How to fix or mitigate CVE-2026-2879?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Insecure Direct Object Refere and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-2879

EUVD-2026-11764 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-13 Wordfence

WordPress Authentication Bypass

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 09:00 euvd

EUVD-2026-11764

Analysis Generated

Mar 13, 2026 - 09:00 vuln.today

CVE Published

Mar 13, 2026 - 08:25 nvd

MEDIUM 5.4

DescriptionCVE.org

The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2. This is due to missing validation on the id parameter in the create() method of the GetGenieChat REST API endpoint. The method accepts a user-controlled post ID and, when a post with that ID exists, calls wp_update_post() without verifying that the current user owns the post or that the post is of the expected getgenie_chat type. This makes it possible for authenticated attackers, with Author-level access and above, to overwrite arbitrary posts owned by any user - including Administrators - effectively destroying the original content by changing its post_type to getgenie_chat and reassigning post_author to the attacker.

AnalysisAI

The GetGenie plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in its REST API endpoint that allows authenticated attackers with Author-level privileges to arbitrarily modify or overwrite posts owned by any user, including administrators. The vulnerability exists in versions up to and including 4.3.2 due to missing validation on user-controlled post IDs before calling wp_update_post(), enabling attackers to change post types and reassign authorship. While not currently listed in CISA's Known Exploited Vulnerabilities catalog, the low attack complexity (network-based, low privilege requirement) and demonstrated proof-of-concept availability make this a moderate-priority issue for WordPress administrators managing multi-author sites.

Technical ContextAI

The vulnerability resides in the GetGenieChat REST API endpoint's create() method, which handles WordPress post operations. The root cause is classified under CWE-639 (Authorization through User-Controlled Key), a critical authorization flaw where the application fails to validate that the authenticated user has legitimate ownership or access rights to the requested resource. The GetGenie plugin (CPE: cpe:2.3:a:getgenie:getgenie) integrates with WordPress's native post management system and leverages the wp_update_post() function, a core WordPress API for modifying post data. The attack vector is network-based and requires only REST API authentication at the Author role level or above—a permission level commonly granted to content creators and contributors. The vulnerability bypasses WordPress's built-in capability checks by directly manipulating post IDs without verifying post type or ownership, allowing the attacker to reassign post_author and change post_type fields to arbitrary values.

RemediationAI

Immediately upgrade the GetGenie plugin to version 4.3.3 or later, which includes validation of post ownership and post type in the REST API create() method. For WordPress sites unable to patch immediately, implement the following interim controls: restrict REST API access to trusted IP ranges via Web Application Firewall or reverse proxy; revoke Author-level and above privileges from untrusted users and audit existing role assignments; enable WordPress activity logging (via plugins such as Audit Log or Server Logs) to detect unauthorized post modifications; and consider temporarily disabling the GetGenieChat REST endpoint if not in active use. Site administrators should consult the GetGenie security advisory and release notes for version 4.3.3 at the official GetGenie or WordPress plugin repository for patch details and rollout guidance.