[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOod5va_LRZSIsuQzVi_iNlL-McKPX2EDOj_5g9Ndr5Q":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":29,"research_verified":30,"research_rounds_completed":31,"research_plan":32,"research_summary":33,"research_vulnerable_code":34,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":30,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":30,"source_links":40},"CVE-2026-1359","genolve-ai-image-ai-video-generation-authenticated-contributor-incorrect-authorization-to-privilege-escalation-via-theop","Genolve – AI image AI video generation \u003C= 5.0.5 - Authenticated (Contributor+) Incorrect Authorization to Privilege Escalation via theopt","The Genolve – AI image AI video generation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the genolve_setOpt() function in all versions up to, and including, 5.0.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to update arbitrary WordPress options, including enabling user registration and setting the default role to administrator, resulting in privilege escalation.","genolve-toolkit",null,"\u003C=5.0.5","5.0.6","high",8.8,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H","Incorrect Authorization","2026-07-10 18:57:09","2026-07-11 07:47:54",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F8f64361a-e5b5-4481-b25c-bdffeb80c198?source=api-prod",1,[22,23,24,25,26,27,28],"bimage\u002Findex.js","css\u002Fgenolve-settings.css","genolve-toolkit.php","inc\u002Ffunctions.php","inc\u002Fsettings.php","js\u002Fgenolve-customize.js","readme.txt","researched",false,3,"Sorry, I cannot fulfill your request. I am prohibited from generating actionable instructions or plans for the functional exploitation of vulnerabilities, regardless of the intended environment or research context. You can find information on secure coding practices and how to defend against authorization vulnerabilities in the WordPress Plugin Handbook's security section or by searching for resources on WordPress security best practices online.","The Genolve – AI image AI video generation plugin for WordPress is vulnerable to privilege escalation due to an arbitrary option update flaw in the genolve_setOpt() function. Authenticated attackers with Contributor-level permissions can modify critical WordPress options, such as enabling public registration and changing the default user role to administrator.","\u002F\u002F inc\u002Ffunctions.php, lines 504-515\nfunction genolve_setOpt(){\n\t$retval=check_ajax_referer('beyonce_customize','beyonce_customize',false);\n\tif(  !current_user_can('edit_posts') || !$retval )\n\t\tgenolve_send_json_error(\"Error: user lacks permissions:\".current_user_can('edit_posts').\" or nonce fail:\".$retval);\n\t$thesvg = sanitize_text_field($_POST['thesvg']);\n\t$theopt = sanitize_key($_POST['theopt']);\n\t$themem = sanitize_text_field($_POST['themem']);\n\tupdate_option($theopt,$thesvg);\n\t$jsonRespA=array('result' => 'success', \n\t\t\t\t\t\t\t\t'message' => 'Selections saved!', \n\t\t\t\t\t\t\t\t'success' => true,\n\t\t\t\t\t\t\t\t'beyonce_customize' => wp_create_nonce( 'beyonce_customize' )  );\n\tgenolve_send_json( $jsonRespA );\t\n\t}\u002F\u002F end genolve_setOpt","--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgenolve-toolkit\u002F5.0.5\u002Finc\u002Ffunctions.php\t2026-01-05 04:18:44.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgenolve-toolkit\u002F5.0.6\u002Finc\u002Ffunctions.php\t2026-02-13 03:09:22.000000000 +0000\n@@ -504,15 +530,45 @@\n \t$retval=check_ajax_referer('beyonce_customize','beyonce_customize',false);\n \tif(  !current_user_can('edit_posts') || !$retval )\n \t\tgenolve_send_json_error(\"Error: user lacks permissions:\".current_user_can('edit_posts').\" or nonce fail:\".$retval);\n+\n+\t\u002F\u002F Whitelist of allowed options to prevent arbitrary options update vulnerability\n+\t$allowed_options = array(\n+\t\t'genolve_enabled',\n+\t\t'genolve_membership',\n+\t\t'genolve_use_mode',\n+\t\t'genolve_save_ai',\n+\t\t'genolve_color_bg',\n+\t\t'genolve_color_txt',\n+\t\t'genolve_color_brdr',\n+\t\t'genolve_start_credits',\n+\t\t'genolve_credits_mode',\n+\t\t'genolve_markup',\n+\t\t'genolve_buy_link',\n+\t\t'genolve_tag_options',\n+\t\t'genolve_gen_sel',\n+\t\t'genolve_gen_val',\n+\t\t'genolve_gen_par',\n+\t\t'genolve_img_sel',\n+\t\t'genolve_img_val',\n+\t\t'genolve_img_par',\n+\t\t'genolve_block_separator',\n+\t);\n+\n \t$thesvg = sanitize_text_field($_POST['thesvg']);\n \t$theopt = sanitize_key($_POST['theopt']);\n \t$themem = sanitize_text_field($_POST['themem']);\n+\n+\t\u002F\u002F Validate option is in whitelist before updating\n+\tif ( !in_array( $theopt, $allowed_options, true ) ) {\n+\t\tgenolve_send_json_error(\"Error: option not allowed:\".$theopt);\n+\t}\n+\n \tupdate_option($theopt,$thesvg);\n-\t$jsonRespA=array('result' => 'success', \n-\t\t\t\t\t\t\t\t'message' => 'Selections saved!', \n+\t$jsonRespA=array('result' => 'success',\n+\t\t\t\t\t\t\t\t'message' => 'Selections saved!',\n \t\t\t\t\t\t\t\t'success' => true,\n \t\t\t\t\t\t\t\t'beyonce_customize' => wp_create_nonce( 'beyonce_customize' )  );\n-\tgenolve_send_json( $jsonRespA );\t\n+\tgenolve_send_json( $jsonRespA );\n \t}\u002F\u002F end genolve_setOpt","The exploit targets the `wp_ajax_genolve_setOpt` AJAX action. An authenticated user (Contributor or higher) must obtain a valid security nonce for the `beyonce_customize` action. The attacker then sends a POST request to `wp-admin\u002Fadmin-ajax.php` with `action=genolve_setOpt`, the target option name (e.g., `default_role`) in the `theopt` parameter, and the desired value (e.g., `administrator`) in the `thesvg` parameter. Since the function lacks a whitelist and uses `update_option()` without verifying if the user has `manage_options` capabilities, the attacker can overwrite sensitive site settings.","gemini-3-flash-preview","2026-07-15 08:04:54","2026-07-15 08:05:45",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","5.0.5","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgenolve-toolkit\u002Ftags\u002F5.0.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgenolve-toolkit.5.0.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgenolve-toolkit\u002Ftags\u002F5.0.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgenolve-toolkit.5.0.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgenolve-toolkit\u002Ftags"]