Insecure Direct Object Reference in GetGenie Plugin for WordPress

CVE-2026-2879

What is CVE-2026-2879?

The GetGenie plugin for WordPress is susceptible to an Insecure Direct Object Reference vulnerability due to inadequate validation of the id parameter in its REST API endpoint. This flaw allows authenticated attackers with Author-level access or greater to modify arbitrary posts by simply providing a valid post ID, which potentially belongs to another user. As a result, attackers can alter the content of posts, including those owned by Administrators, by changing their post_type to getgenie_chat and reassigning the post_author. This manipulation risks compromising the integrity of the content across multiple user accounts.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References