The GetGenie WordPress plugin contains an Insecure Direct Object Reference that allows an authenticated user with Author or higher privileges to change post metadata through the REST API. Because the plugin does not validate the user-controlled action key and does not sanitize input, a malicious attacker can inject script payloads into the "Competitor" tab of a post. When a higher‑privileged user, such as an Administrator, opens that post, the stored script is executed in the victim’s browser. This vulnerability is identified as CWE‑639 (Missing Authorization).

All roxnor:GetGenie WordPress plugin releases up to and including version 4.3.2 are affected. The known source code path app/Api/Store.php shows the insecure handling of the action key. No more granular sub‑version information is provided, so any deployment of 4.3.2 or earlier should be considered vulnerable.

The CVSS v3.1 score is 6.4, indicating medium severity. The EPSS score is reported as less than 1 %, so exploitation is considered unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access with at least Author privileges. The attacker must modify post metadata and then wait for an administrator to view the post to activate the stored script. No publicly available exploit code is noted; the risk depends on the prevalence of the plugin and the availability of users with sufficient privileges.