CVE-2026-1003

GetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools <= 4.3.0 - Missing Authorization to Authenticated (Author+) Arbitrary Post Deletion

View on CVE.org
Published Jan 16, 2026 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Description
The GetGenie plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.0. This is due to the plugin not properly verifying that a user is authorized to delete a specific post. This makes it possible for authenticated attackers, with Author-level access and above, to delete any post on the WordPress site, including posts authored by other users.

Analysis

AI-generated

Technical impact

The GetGenie plugin does not verify that a user is authorized to delete a specific post. Consequently, any authenticated user with an Author role or higher can delete any post on the WordPress site, regardless of authorship. This privilege escalation can lead to loss of content, defacement, or disruption of the site’s editorial workflow.

Affected Systems

The vulnerability affects the roxnor GetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools plugin for WordPress. All releases up to and including version 4.3.0 are impacted. Users of version 4.3.1 and later are not affected.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate severity. The EPSS score of less than 1% reflects a low likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog. Attackers must already be authenticated with Author or higher privileges and can exploit the vulnerability through the plugin’s API endpoint that handles post deletion. No additional privileges or external vulnerabilities are required beyond those provided by the target user role.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update GetGenie to version 4.3.1 or later, ensuring the authorization check is restored.
  • Restrict Author-level users from the ability to delete posts if such permissions are unnecessary for their workflow.
  • Audit and monitor post deletion activity, potentially using a logging plugin, to detect unauthorized deletions.

Generated by OpenCVE AI on April 15, 2026 at 19:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description The GetGenie plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.0. This is due to the plugin not properly verifying that a user is authorized to delete a specific post. This makes it possible for authenticated attackers, with Author-level access and above, to delete any post on the WordPress site, including posts authored by other users.
Title GetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools <= 4.3.0 - Missing Authorization to Authenticated (Author+) Arbitrary Post Deletion
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
Wordfence
Published
Updated
Apr 8, 2026, 4:46 PM
Reserved
Jan 15, 2026, 7:13 PM

View source JSON

Updated
Jan 16, 2026, 1:50 PM

JSON

Status
Deferred
Published
Jan 16, 2026, 8:15 AM
Modified
Jun 17, 2026, 10:14 AM

View source JSON

No data.

Updated
Apr 15, 2026, 7:15 PM

JSON