CVE-2026-1003

The GetGenie plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.0. This is due to the plugin not properly verifying that a user is authorized to delete a specific post. This makes it possible for authenticated attackers, with Author-level access and above, to delete any post on the WordPress site, including posts authored by other users.

• CWE-862

• https://plugins.trac.wordpress.org/browser/getgenie/trunk/app/Api/GetGenieChat.php#L153
• https://plugins.trac.wordpress.org/changeset/3436920/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/38ec647a-3c0c-4d3c-ba34-64c17803867b?source=cve

Published

Jan 16, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10022Type Confusion in V8 in Google Chrome prior to 148.0.7778.21…7.5
• CVE-2026-10023The Dokan: AI Powered WooCommerce Multivendor Marketplace So…4.3
• CVE-2026-10024The TinyMCE shortcode Addon plugin for WordPress is vulnerab…6.4
• CVE-2026-10025IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 …9.8
• CVE-2026-10028A flaw was found in glib-networking. A remote attacker can e…4.3
• CVE-2026-10029The Event Koi Lite – Events Calendar, Event Management, RSVP…5.3
• CVE-2026-10031SFTPGo prior to 2.7.4 contains a permission bypass vulnerabi…4.2
• CVE-2026-10032The openUrl function in @a2ui/web_core passes an agent-contr…6.1
• CVE-2026-10033The EventON Action User plugin for WordPress is vulnerable t…7.3
• CVE-2026-10034The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable…5.3
• CVE-2026-10037A sandbox escape vulnerability exists in the OpenJDK package…8.8
• CVE-2026-10038The Charitable – Donation Plugin for WordPress – Fundraising…4.3