CVE-2026-24356CWE-862

WordPress GetGenie plugin <= 4.3.0 - Broken Access Control vulnerability

Medium · published January 22, 2026

CVSS v3.1
4.9
EPSS
0%
Percentile
19.0
In the wild
Unconfirmed
What it is

⚠️ Missing authorization checks in GetGenie could let anyone access restricted features — it's like a restaurant where the kitchen serves anyone who walks in, regardless of their reservation! Picture a restaurant with an open kitchen where anyone can stroll right in and grab whatever they want, no questions asked. This vulnerability in GetGenie allows users to exploit incorrectly configured access control security levels, essentially bypassing any reservations that were supposed to be enforced. An attacker could gain unauthorized access to sensitive features or data, leading to potential data leaks or misuse. While it's not a catastrophic breach, the implications could be significant if sensitive information falls into the wrong hands. Security loopholes like this one can create vulnerabilities that lead to bigger issues down the road!

Put simply

Picture a restaurant with an open kitchen where anyone can stroll right in and grab whatever they want, no questions asked. This vulnerability in GetGenie allows users to exploit incorrectly configured access control security levels, essentially bypassing any reservations that were supposed to be enforced. The missing authorization vulnerability in GetGenie versions up to 4.3.0 allows unauthorized users to access restricted areas due to poorly configured access controls. This means that security levels intended to protect sensitive functionality aren't functioning as they should.

What to do

An attacker could gain unauthorized access to sensitive features or data, leading to potential data leaks or misuse. While it's not a catastrophic breach, the implications could be significant if sensitive information falls into the wrong hands. Security loopholes like this one can create vulnerabilities that lead to bigger issues down the road! To mitigate this risk, audit your access control settings to ensure they're properly configured. Update GetGenie to the latest version and review user permissions to ensure they align with your security policies. Regularly check for updates to avoid similar vulnerabilities in the future! You've got this! By taking these steps, you'll shore up your defenses and keep your system secure! 🛡️

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00276 · 19.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-22T16:52Z
EPSS history
Timeline
  • 22 JAN 16:52Z
    WordPress GetGenie plugin <= 4.3.0 - Broken Access Control vulnerability
    cvelistv5