{"id":"CVE-2026-1003","aliases":["EUVD-2026-2957","GHSA-q9rr-5jh9-qw58"],"status":"published","title":"GetGenie – AI Content Writer with Keyword Research \u0026 SEO Tracking Tools \u003c= 4.3.0 - Missing Authorization to Authenticated (Author+) Arbitrary Post Deletion","description":"The GetGenie plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.0. This is due to the plugin not properly verifying that a user is authorized to delete a specific post. This makes it possible for authenticated attackers, with Author-level access and above, to delete any post on the WordPress site, including posts authored by other users.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00248,"percentile":0.1615,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-01-16T07:23:09Z","modified":"2026-06-17T10:14:50Z","products":[{"vendor":"roxnor","product":"getgenie – ai content writer with keyword research \u0026 seo tracking tools"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38ec647a-3c0c-4d3c-ba34-64c17803867b?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/getgenie/trunk/app/Api/GetGenieChat.php#L153"},{"url":"https://plugins.trac.wordpress.org/changeset/3436920/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1003"},{"url":"https://plugins.trac.wordpress.org/changeset/3436920"},{"url":"https://github.com/advisories/GHSA-q9rr-5jh9-qw58"}],"sources":{"cve":[{"id":"CVE-2026-1003","title":"GetGenie – AI Content Writer with Keyword Research \u0026 SEO Tracking Tools \u003c= 4.3.0 - Missing Authorization to Authenticated (Author+) Arbitrary Post Deletion","description":"The GetGenie plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.0. This is due to the plugin not properly verifying that a user is authorized to delete a specific post. This makes it possible for authenticated attackers, with Author-level access and above, to delete any post on the WordPress site, including posts authored by other users.","status":"published","published":"2026-01-16T07:23:09.127Z","modified":"2026-04-08T16:46:39.335Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:20:00.879257Z"}],"euvd":[{"id":"EUVD-2026-2957","description":"The GetGenie plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.0. This is due to the plugin not properly verifying that a user is authorized to delete a specific post. This makes it possible for authenticated attackers, with Author-level access and above, to delete any post on the WordPress site, including posts authored by other users.","status":"published","published":"2026-01-16T07:23:09Z","modified":"2026-04-08T16:46:39Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:02.846408Z"}],"ghsa":[{"id":"GHSA-q9rr-5jh9-qw58","title":"The GetGenie plugin for WordPress is vulnerable to authorization bypass in all versions up to,...","description":"The GetGenie plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.0. This is due to the plugin not properly verifying that a user is authorized to delete a specific post. This makes it possible for authenticated attackers, with Author-level access and above, to delete any post on the WordPress site, including posts authored by other users.","status":"published","published":"2026-01-16T09:31:21Z","modified":"2026-01-16T09:31:26Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:05:38.741943Z"}],"nvd":[{"id":"CVE-2026-1003","description":"The GetGenie plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.0. This is due to the plugin not properly verifying that a user is authorized to delete a specific post. This makes it possible for authenticated attackers, with Author-level access and above, to delete any post on the WordPress site, including posts authored by other users.","status":"published","published":"2026-01-16T08:15:46.557Z","modified":"2026-06-17T10:14:50.483Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:04.066712Z"}]}}