CVE-2026-1003

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1003", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-15T19:13:12.832Z", "datePublished": "2026-01-16T07:23:09.127Z", "dateUpdated": "2026-04-08T16:46:39.335Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:46:39.335Z"}, "affected": [{"vendor": "roxnor", "product": "GetGenie \u2013 AI Content Writer with Keyword Research & SEO Tracking Tools", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.3.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The GetGenie plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.0. This is due to the plugin not properly verifying that a user is authorized to delete a specific post. This makes it possible for authenticated attackers, with Author-level access and above, to delete any post on the WordPress site, including posts authored by other users."}], "title": "GetGenie \u2013 AI Content Writer with Keyword Research & SEO Tracking Tools <= 4.3.0 - Missing Authorization to Authenticated (Author+) Arbitrary Post Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/38ec647a-3c0c-4d3c-ba34-64c17803867b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/getgenie/trunk/app/Api/GetGenieChat.php#L153"}, {"url": "https://plugins.trac.wordpress.org/changeset/3436920/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Youcef Hamdani"}], "timeline": [{"time": "2026-01-06T13:48:27.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-15T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-16T13:49:14.569995Z", "id": "CVE-2026-1003", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T13:50:30.935Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1003", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-16T13:49:14.569995Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T13:50:22.748Z"}}], "cna": {"title": "GetGenie \u2013 AI Content Writer with Keyword Research & SEO Tracking Tools <= 4.3.0 - Missing Authorization to Authenticated (Author+) Arbitrary Post Deletion", "credits": [{"lang": "en", "type": "finder", "value": "Youcef Hamdani"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "roxnor", "product": "GetGenie \u2013 AI Content Writer with Keyword Research & SEO Tracking Tools", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.3.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-06T13:48:27.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-15T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/38ec647a-3c0c-4d3c-ba34-64c17803867b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/getgenie/trunk/app/Api/GetGenieChat.php#L153"}, {"url": "https://plugins.trac.wordpress.org/changeset/3436920/"}], "descriptions": [{"lang": "en", "value": "The GetGenie plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.0. This is due to the plugin not properly verifying that a user is authorized to delete a specific post. This makes it possible for authenticated attackers, with Author-level access and above, to delete any post on the WordPress site, including posts authored by other users."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:46:39.335Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1003", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:46:39.335Z", "dateReserved": "2026-01-15T19:13:12.832Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-16T07:23:09.127Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "GetGenie \u2013 AI Content Writer with Keyword Research & SEO Tracking Tools", "vendor": "roxnor", "versions": [{"lessThanOrEqual": "4.3.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The GetGenie plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.0. This is due to the plugin not properly verifying that a user is authorized to delete a specific post. This makes it possible for authenticated attackers, with Author-level access and above, to delete any post on the WordPress site, including posts authored by other users."}, {"lang": "es", "value": "El plugin GetGenie para WordPress es vulnerable a una omisi\u00f3n de autorizaci\u00f3n en todas las versiones hasta la 4.3.0, inclusive. Esto se debe a que el plugin no verifica correctamente que un usuario est\u00e1 autorizado para eliminar una publicaci\u00f3n espec\u00edfica. Esto hace posible que atacantes autenticados, con acceso de nivel Autor y superior, eliminen cualquier publicaci\u00f3n en el sitio de WordPress, incluidas las publicaciones creadas por otros usuarios."}], "id": "CVE-2026-1003", "lastModified": "2026-06-17T10:14:50.483", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1003", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-16T13:49:14.569995Z", "version": "2.0.3"}}]}, "published": "2026-01-16T08:15:46.557", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/getgenie/trunk/app/Api/GetGenieChat.php#L153"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3436920/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/38ec647a-3c0c-4d3c-ba34-64c17803867b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T19:10:17.109386+00:00", "value": {"mitigation_remediation": ["Update GetGenie to version 4.3.1 or later, ensuring the authorization check is restored.", "Restrict Author-level users from the ability to delete posts if such permissions are unnecessary for their workflow.", "Audit and monitor post deletion activity, potentially using a logging plugin, to detect unauthorized deletions."], "summary": {"action": "Apply Patch", "impact": "Arbitrary Post Deletion"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the roxnor GetGenie \u2013 AI Content Writer with Keyword Research & SEO Tracking Tools plugin for WordPress. All releases up to and including version 4.3.0 are impacted. Users of version\u202f4.3.1 and later are not affected.", "description_and_impact": "The GetGenie plugin does not verify that a user is authorized to delete a specific post. Consequently, any authenticated user with an Author role or higher can delete any post on the WordPress site, regardless of authorship. This privilege escalation can lead to loss of content, defacement, or disruption of the site\u2019s editorial workflow.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity. The EPSS score of less than 1% reflects a low likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog. Attackers must already be authenticated with Author or higher privileges and can exploit the vulnerability through the plugin\u2019s API endpoint that handles post deletion. No additional privileges or external vulnerabilities are required beyond those provided by the target user role."}}}}, "created": "2026-01-16T13:41:32.049942+00:00", "updated": "2026-04-15T19:15:12.081811+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}