EUVD-2026-39729
GHSA-3rvx-h374-mgc3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible WordPress endpoint requires only subscriber auth (PR:L); no integrity or availability impact; high confidentiality loss aligns with sensitive data exfiltration scope.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
1DescriptionCVE.org
Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions.
AnalysisAI
Sensitive data exposure in GetGenie WordPress plugin (versions through 4.4.2) permits authenticated subscribers to access data outside their authorization scope. The vulnerability, classified under CWE-497, enables low-privilege WordPress users - those with subscriber-level accounts - to retrieve sensitive information that should be restricted to higher-privilege roles. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, but the low attack complexity and broad user-privilege threshold make this a realistic risk on any multi-user WordPress deployment running an affected version.
Technical ContextAI
GetGenie is a WordPress plugin providing AI-driven content generation and SEO assistance functionality. CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) describes a class of flaws where application logic fails to enforce access boundaries, allowing a lower-trust principal to query or retrieve data objects that should only be visible to more privileged roles. In WordPress context, this commonly manifests as REST API endpoints, AJAX handlers, or admin-area queries that check only for a logged-in session (capability 'read', typically granted to subscribers) rather than verifying a higher capability such as 'manage_options' or a plugin-specific role check. The CVSS vector AV:N/AC:L/PR:L confirms the vulnerability is reachable over the network with only a valid low-privilege authenticated session and no additional preconditions. The affected CPE covers GetGenie versions up to and including 4.4.2.
RemediationAI
The primary remediation is to update the GetGenie plugin to the latest available version beyond 4.4.2 via the WordPress admin panel (Plugins → Updates) or WP-CLI ('wp plugin update getgenie'). The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/getgenie/vulnerability/wordpress-getgenie-plugin-4-4-2-sensitive-data-exposure-vulnerability should be consulted to confirm the exact patched release version, which was not independently confirmed in the available intelligence data. As a compensating control where immediate patching is not possible, administrators should disable open user registration (Settings → General → uncheck 'Anyone can register') to prevent unauthenticated parties from obtaining a subscriber account, thereby eliminating the primary attack path. For sites requiring open registration, a Web Application Firewall rule blocking unexpected access to GetGenie-specific REST or AJAX endpoints by subscriber-role sessions can reduce exposure, though this may impair legitimate plugin functionality. No workaround fully substitutes for the vendor patch.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today