ZeroDay Findings
Sign inSign up

Findings

CVE-2026-2879

The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2.

Published Mar 13, 2026 · updated Jun 17, 2026

The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2. This is due to missing validation on the parameter in the method of the REST API endpoint. The method accepts a user-controlled post ID and, when a post with that ID exists, calls without verifying that the current user owns the post or that the post is of the expected type. This makes it possible for authenticated attackers, with Author-level access and above, to overwrite arbitrary posts owned by any user — including Administrators — effectively destroying the original content by changing its to and reassigning to the attacker.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 13, 2026 · NIST NVD

    Detected

    The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2. This is due to missing validation on the parameter in the method of the REST API endpoint. The method accepts a user-controlled post ID and, when a post with that ID exists, calls without verifying that the current user owns the post or that the post is of the expected t

  2. Jun 17, 2026 · NIST NVD

    Updated

    The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2. This is due to missing validation on the parameter in the method of the REST API endpoint. The method accepts a user-controlled post ID and, when a post with that ID exists, calls without verifying that the current user owns the post or that the post is of the expected t

Sources

  • CVE.orgVulnerability recordCVE-2026-2879

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-2879

    The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2. This is due to missing validation on the parameter in the method of the REST API endpoint. The method accepts a user-con

    nvd.nist.gov

References