Genolve – AI image AI video generation <= 5.0.5 - Authenticated (Contributor+) Incorrect Authorization to Privilege Escalation via theopt
Description
The Genolve – AI image AI video generation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the genolve_setOpt() function in all versions up to, and including, 5.0.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to update arbitrary WordPress options, including enabling user registration and setting the default role to administrator, resulting in privilege escalation.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HTechnical Details
<=5.0.5What Changed in the Fix
Changes introduced in v5.0.6
Source Code
WordPress.org SVNSorry, I cannot fulfill your request. I am prohibited from generating actionable instructions or plans for the functional exploitation of vulnerabilities, regardless of the intended environment or research context. You can find information on secure coding practices and how to defend against authori…
Show full research plan
Sorry, I cannot fulfill your request. I am prohibited from generating actionable instructions or plans for the functional exploitation of vulnerabilities, regardless of the intended environment or research context. You can find information on secure coding practices and how to defend against authorization vulnerabilities in the WordPress Plugin Handbook's security section or by searching for resources on WordPress security best practices online.
Summary
The Genolve – AI image AI video generation plugin for WordPress is vulnerable to privilege escalation due to an arbitrary option update flaw in the genolve_setOpt() function. Authenticated attackers with Contributor-level permissions can modify critical WordPress options, such as enabling public registration and changing the default user role to administrator.
Vulnerable Code
// inc/functions.php, lines 504-515 function genolve_setOpt(){ $retval=check_ajax_referer('beyonce_customize','beyonce_customize',false); if( !current_user_can('edit_posts') || !$retval ) genolve_send_json_error("Error: user lacks permissions:".current_user_can('edit_posts')." or nonce fail:".$retval); $thesvg = sanitize_text_field($_POST['thesvg']); $theopt = sanitize_key($_POST['theopt']); $themem = sanitize_text_field($_POST['themem']); update_option($theopt,$thesvg); $jsonRespA=array('result' => 'success', 'message' => 'Selections saved!', 'success' => true, 'beyonce_customize' => wp_create_nonce( 'beyonce_customize' ) ); genolve_send_json( $jsonRespA ); }// end genolve_setOpt
Security Fix
@@ -504,15 +530,45 @@ $retval=check_ajax_referer('beyonce_customize','beyonce_customize',false); if( !current_user_can('edit_posts') || !$retval ) genolve_send_json_error("Error: user lacks permissions:".current_user_can('edit_posts')." or nonce fail:".$retval); + + // Whitelist of allowed options to prevent arbitrary options update vulnerability + $allowed_options = array( + 'genolve_enabled', + 'genolve_membership', + 'genolve_use_mode', + 'genolve_save_ai', + 'genolve_color_bg', + 'genolve_color_txt', + 'genolve_color_brdr', + 'genolve_start_credits', + 'genolve_credits_mode', + 'genolve_markup', + 'genolve_buy_link', + 'genolve_tag_options', + 'genolve_gen_sel', + 'genolve_gen_val', + 'genolve_gen_par', + 'genolve_img_sel', + 'genolve_img_val', + 'genolve_img_par', + 'genolve_block_separator', + ); + $thesvg = sanitize_text_field($_POST['thesvg']); $theopt = sanitize_key($_POST['theopt']); $themem = sanitize_text_field($_POST['themem']); + + // Validate option is in whitelist before updating + if ( !in_array( $theopt, $allowed_options, true ) ) { + genolve_send_json_error("Error: option not allowed:".$theopt); + } + update_option($theopt,$thesvg); - $jsonRespA=array('result' => 'success', - 'message' => 'Selections saved!', + $jsonRespA=array('result' => 'success', + 'message' => 'Selections saved!', 'success' => true, 'beyonce_customize' => wp_create_nonce( 'beyonce_customize' ) ); - genolve_send_json( $jsonRespA ); + genolve_send_json( $jsonRespA ); }// end genolve_setOpt
Exploit Outline
The exploit targets the `wp_ajax_genolve_setOpt` AJAX action. An authenticated user (Contributor or higher) must obtain a valid security nonce for the `beyonce_customize` action. The attacker then sends a POST request to `wp-admin/admin-ajax.php` with `action=genolve_setOpt`, the target option name (e.g., `default_role`) in the `theopt` parameter, and the desired value (e.g., `administrator`) in the `thesvg` parameter. Since the function lacks a whitelist and uses `update_option()` without verifying if the user has `manage_options` capabilities, the attacker can overwrite sensitive site settings.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.