The GetGenie WordPress plugin suffers from an Insecure Direct Object Reference (CWE-639) that allows authenticated users with Author-level or higher privileges to overwrite arbitrary posts. The vulnerability arises when the create() method of the GetGenieChat REST API accepts a user-controlled post ID and calls wp_update_post() without verifying ownership or ensuring the post is of the expected getgenie_chat type. An attacker can therefore replace any existing post, including those owned by administrators, changing the post_type to getgenie_chat and reassigning post_author to the attacker. This leads to loss of content integrity and potential denial of service on the affected posts.

All installations of the roxnor:GetGenie AI Content Writer for WordPress plugin up to and including version 4.3.2 are affected. The bug exists consistently across all builds up to 4.3.2, regardless of minor sub‑releases.

The CVSS score is 5.4, indicating moderate severity. The EPSS score is less than 1 %, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be authenticated with at least Author permissions and to know a post ID that exists on the site. Because the exposed endpoint accepts a public post ID and performs an update without ownership checks, the attack vector is internal and the exploitation path is straightforward once credentials are available. Given the moderate impact to content integrity and the low probability of exploitation, the overall risk is moderate if the vulnerable plugin version remains in use.