The GetGenie plugin suffers from a missing authorization flaw that allows an attacker to exploit incorrectly configured access controls. This weakness means that users or code paths that should be protected can be accessed without proper permissions, potentially leading to data exposure or unauthorized manipulation of the WordPress site. The vulnerability is categorized under CWE-862, highlighting its effect on authentication and access control mechanisms.

WordPress sites using the Roxnor GetGenie plugin, versions up to and including 4.3.0. The relevant vendor/product is Roxnor:GetGenie, and any installation of this plugin within the specified version range is susceptible to this vulnerability.

With a CVSS score of 8.8, the flaw is considered High severity. The EPSS score is below 1%, indicating low historical exploitation rates, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated user leveraging the plugin’s exposed endpoints that lack proper authorization checks. An attacker may need valid user credentials or could use an account with elevated privileges to exploit the bug, enabling them to perform actions that should be restricted. In the absence of additional constraints, the risk is high for sites where the plugin is enabled and misconfigured.