CVE-2026-2879

The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2. This is due to missing validation on the id parameter in the create() method of the GetGenieChat REST API endpoint. The method accepts a user-controlled post ID and, when a post with that ID exists, calls wp_update_post() without verifying that the current user owns the post or that the post is of the expected getgenie_chat type. This makes it possible for authenticated attackers, with Author-level access and above, to overwrite arbitrary posts owned by any user — including Administrators — effectively destroying the original content by changing its post_type to getgenie_chat and reassigning post_author to the attacker.

The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2. This is due to missing validation on the id parameter in the create() method of the GetGenieChat REST API endpoint. The method accepts a user-controlled post ID and, when a post with that ID exists, calls wp_update_post() without verifying that the current user owns the post or that the post is of the expected getgenie_chat type. This makes it possible for authenticated attackers, with Author-level access and above, to overwrite arbitrary posts owned by any user — including Administrators — effectively destroying the original content by changing its post_type to getgenie_chat and reassigning post_author to the attacker.

The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2. This is due to missing validation on the id parameter in the create() method of the GetGenieChat REST API endpoint. The method accepts a user-controlled post ID and, when a post with that ID exists, calls wp_update_post() without verifying that the current user owns the post or that the post is of the expected getgenie_chat type. This makes it possible for authenticated attackers, with Author-level access and above, to overwrite arbitrary posts owned by any user — including Administrators — effectively destroying the original content by changing its post_type to getgenie_chat and reassigning post_author to the attacker.

The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2. This is due to missing validation on the id parameter in the create() method of the GetGenieChat REST API endpoint. The method accepts a user-controlled post ID and, when a post with that ID exists, calls wp_update_post() without verifying that the current user owns the post or that the post is of the expected getgenie_chat type. This makes it possible for authenticated attackers, with Author-level access and above, to overwrite arbitrary posts owned by any user — including Administrators — effectively destroying the original content by changing its post_type to getgenie_chat and reassigning post_author to the attacker.