GetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools <= 4.3.0 - Missing Authorization to Authenticated (Author+) Arbitrary Post Deletion

This research plan outlines the steps to verify and exploit CVE-2026-1003, a missing authorization vulnerability in the GetGenie plugin that allows users with Author-level permissions to delete any post on the site.

1. Vulnerability Summary

The GetGenie plugin (<= 4.3.0) fails to implement proper ownership or capability checks in one of its AJAX/REST handlers responsible for deleting content (likely AI generation history or templates). While the handler may check if a user is logged in or has a baseline capability (like edit_posts), it does not verify if the authenticated user has the permission to delete the specific post_id provided in the request. This allows an Author to delete posts created by Administrators or other users.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: getgenie_delete_history (inferred based on plugin functionality) or getgenie_remove_item.
• Vulnerable Parameter: post_id or id.
• Authentication: Authenticated, Author-level access (PR:L).
• Preconditions: The attacker must be logged in as a user with at least the Author role. The ID of the target post (e.g., a high-value page or post created by the admin) must be known.

3. Code Flow (Inferred)

1. The plugin registers an AJAX handler for a delete action via add_action( 'wp_ajax_getgenie_delete_history', ... ).
2. The handler function retrieves the post_id from $_POST or $_GET.
3. The handler performs a nonce check (e.g., check_ajax_referer).
4. The handler may check if the user can edit_posts (which Authors can).
5. Vulnerability: The code proceeds to call wp_delete_post( $post_id, true ) or wp_trash_post( $post_id ) without calling current_user_can( 'delete_post', $post_id ).
6. The post is deleted regardless of its author.

4. Nonce Acquisition Strategy

The GetGenie plugin typically localizes its configuration and nonces for the admin dashboard.

1. Identify the Script: Look for wp_localize_script calls in the plugin source that target the "History" or "AI Content" pages.
2. JS Variable: Likely names include getgenie_admin, getgenie_history, or getgenie_config.
3. Target Page: The GetGenie history page (e.g., /wp-admin/admin.php?page=getgenie-history).

Acquisition Plan:

1. Navigate to the GetGenie History page as an Author.
2. Use browser_eval to extract the nonce:

   // Inferred localization key - replace with actual key found during discovery
   window.getgenie_history?.nonce || window.getgenie_admin?.nonce
   

5. Exploitation Strategy

Step 1: Target Identification
Identify a post ID created by the Administrator (e.g., Post ID 1).

Step 2: Nonce Retrieval
As the Author user, navigate to the GetGenie History management page and extract the nonce using the browser_eval tool.

Step 3: Execution of Delete Request
Perform an authenticated POST request to admin-ajax.php.

• URL: http://<target>/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Payload (Draft):

  action=getgenie_delete_history&post_id=1&_wpnonce=<NONCE_VALUE>
  

  (Note: If the action name or parameter name differs upon inspection of the source, adjust accordingly.)

6. Test Data Setup

1. Administrator Post: Create a post titled "ADMIN SECURE POST" with ID 1 (or capture the ID).
2. Author User: Create a user with the author role.
3. Plugin Activation: Ensure GetGenie <= 4.3.0 is installed and activated.
4. Shortcode/Page (if needed): If the history page is blank, generate at least one "Genie" history item via the AI writer to ensure the scripts and nonces are properly initialized in the DOM.

7. Expected Results

• HTTP Response: A success status code (200 OK) and a JSON response like {"success": true} or 1.
• State Change: The post with the target ID (owned by Admin) should no longer exist in the wp_posts table or should be moved to the trash.

8. Verification Steps

1. Check Post Existence via WP-CLI:

   wp post exists 1
   # Should return a non-zero exit code if deleted, or check:
   wp post list --post_type=any --include=1
   

2. Verify Trash status:

   wp post list --post_status=trash --include=1
   

9. Alternative Approaches

• REST API: Check if GetGenie registers custom REST API routes under /wp-json/getgenie/v1/. If the vulnerability exists in a REST endpoint, the request would use the X-WP-Nonce header.
• Bulk Delete: Look for parameters that accept arrays (e.g., ids[]) which might allow for mass deletion of posts in a single request.
• Default Nonce: If wp_verify_nonce( ..., -1 ) is used, try using any valid nonce obtained from the admin dashboard.