Vulnerability Intelligence Report
GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST API
CVE-2026-2257
The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2 due to missing validation on a user controlled key in the `action` function. This makes it possible for authenticated attackers, with Author-level access and above, to update post metadata for arbitrary posts. Combined with a lack of input sanitization, this leads to Stored Cross-Site Scripting when a higher-privileged user (such as an Administrator) views the affected post's "Competitor" tab in the GetGenie sidebar.
No Active Exploit Signals
CVSS Base Score
6.4
MEDIUM
Exploitability:3.2
Impact Score:2.8
EPSS Probability:0.23%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-639 ↗CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| roxnor | GetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools | 0 <= 4.3.2 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.228%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Wordfence · Vendor · USA |
| Reserved | 2026-02-09T15:32:20 |
| Published | 2026-03-13T08:25:16 |
| Last Updated | 2026-04-08T16:35:43 |
Community Chatter & Buzz