Vulnerability Description
The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2 due to missing validation on a user controlled key in the `action` function. This makes it possible for authenticated attackers, with Author-level access and above, to update post metadata for arbitrary posts. Combined with a lack of input sanitization, this leads to Stored Cross-Site Scripting when a higher-privileged user (such as an Administrator) views the affected post's "Competitor" tab in the GetGenie sidebar.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/browser/getgenie/tags/4.3.2/app/Api/Store.php
- https://plugins.trac.wordpress.org/browser/getgenie/tags/4.3.2/app/Api/Store.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0f7b119d-ec56-40cb-80e
FAQ
What is CVE-2026-2257?
CVE-2026-2257 is a vulnerability with a CVSS score of 6.4 (MEDIUM). The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2 due to missing validation on a user controlled key in the `action` funct...
How severe is CVE-2026-2257?
CVE-2026-2257 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-2257?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.