GetGenie WordPress Plugin Authorization Bypass Vulnerability Allowing Arbitrary Post Deletion

A vulnerability exists in the GetGenie plugin for WordPress, affecting all versions up to and including 4.3.0. The issue stems from the plugin's failure to properly verify user authorization for deleting specific posts. As a result, authenticated users with Author-level access or higher can delete any post on the site, including those written by other users.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of posts, potentially leading to loss of important content and disruption of site management.

Reproduction

To reproduce this vulnerability, an authenticated user with Author-level access or higher can send a request to the WordPress REST API to delete a post. The request can include the post ID of any post, regardless of the author, as the plugin does not properly check if the user is authorized to delete that specific post.

Remediation

Users are advised to update the GetGenie WordPress plugin to version 4.3.1 or a later patched version.