EUVD-2026-37054
GHSA-9r53-cqfv-hv84
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running GetGenie <= 4.4.1
-
DeliverySend unauthenticated HTTP request to vulnerable endpoint
-
ExploitReceive response containing sensitive data
-
ExecutionExtract API keys or credentials
-
ImpactAbuse credentials for unauthorized AI API usage or further access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Outbound data filtering
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of GetGenie <= 4.4.1 installed on any WordPress site. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible, low-complexity exploitation requiring no authentication and no user interaction. The sole limiting factor is target selection: only WordPress installations with the GetGenie plugin active at a vulnerable version are affected. No non-default configuration, specific server platform, or user-triggered action is required to trigger the exposure. |
| Impact | The official CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L contains a notable internal inconsistency: the vulnerability is described as 'Sensitive Data Exposure' and classified under CWE-201, yet the vector assigns C:N (no confidentiality impact) while granting I:L and A:L - a combination that does not align with an information disclosure root cause. This appears to be a scoring artifact; the true primary impact is almost certainly confidentiality. The AV:N/AC:L/PR:N/UI:N metrics confirm trivial, unauthenticated, low-complexity network exploitation requiring no user interaction, which elevates real-world risk. No EPSS score, KEV listing, or POC code was included in the provided intelligence. However, unauthenticated endpoints in popular WordPress plugins are routinely mass-scanned, and if AI API keys are among the exposed data, downstream financial and integrity risks compound the base finding. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to the vulnerable GetGenie REST API or admin-ajax endpoint on a target WordPress site running version <= 4.4.1. The plugin responds with output containing sensitive data - such as a stored OpenAI or other AI-provider API key - without verifying the caller's identity. The attacker extracts the key and uses it to make unauthorized AI API calls, incurring costs on the victim's account or accessing proprietary content generation history. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Unauthenticated sensitive data exposure in the GetGenie WordPress plugin (versions <= 4.4.1) allows any remote, unauthenticated attacker to retrieve sensitive information via a network request to an unprotected endpoint. Reported by Patchstack and rooted in CWE-201 (Insertion of Sensitive Information Into Sent Data), the plugin inadvertently includes sensitive data - potentially AI service API keys or configuration values - in HTTP responses that require no authentication. No public exploit code and no active exploitation have been identified at time of analysis.
RemediationAI
Update the GetGenie plugin to a version above 4.4.1 as directed by the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/getgenie/vulnerability/wordpress-getgenie-plugin-4-4-1-sensitive-data-exposure-vulnerability?_s_id=cve. No exact patched release version number was included in the available intelligence - administrators should verify the latest release directly in the WordPress.org plugin repository or wpmet's official channel before updating. As an immediate compensating control pending the update, use Patchstack's virtual patching feature (if subscribed) or a firewall rule to block unauthenticated access to the specific GetGenie REST or AJAX endpoint. Critically, administrators should also audit and rotate any AI API keys stored within GetGenie settings, as these are the most likely sensitive values at risk and may have been silently exfiltrated prior to patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GetGenie (CPE: cpe:2.3:a:wpmet:getgenie:*:*:*:*:*:*:*:*) is an AI-powered content writing assistant plugin for WordPress, developed by wpmet. The root cause is CWE-201 - Insertion of Sensitive Information Into Sent Data - meaning the plugin returns sensitive values (such as stored API keys for integrated AI services or internal configuration data) in HTTP responses accessible without any authentication check. In WordPress, this class of flaw typically arises from REST API routes or admin-ajax.php actions that lack a capability check or nonce validation, exposing data to any network-reachable caller.
Know when Getgenie gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Unauthenticated network-accessible data disclosure warrants C:L; no credible independent integrity or availability impact applies to the vulnerable system.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Sensitive Data Exposure in GetGenie <= 4.4.1 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB