Description

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every front-end page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-13T21:17:01.800Z",
  "pubdate": "2026-09-13T21:17:01.800Z",
  "executiveSummary": "The GenieWords WordPress plugin, specifically versions 1.5.27 through 1.5.34, is susceptible to a critical security vulnerability involving the combination of broken access control and stored cross-site scripting (XSS).\nThis vulnerability originates from the absence of authorization checks on specific REST API and AJAX endpoints, enabling unauthenticated remote attackers to modify the plugin's internal configuration settings.\nBy leveraging these insecure endpoints, an attacker can inject malicious JavaScript payloads into stored configuration values. Because the application subsequently decodes and renders these values without proper sanitization on every front-end page, the injected scripts execute within the browsers of visitors.\nThe impact includes the potential for session hijacking, unauthorized redirection of users, defacement of the website, and the exfiltration of sensitive information.\nThis vulnerability presents a high risk as it requires no prior authentication or administrative privileges to execute. Administrators are advised to update the plugin immediately or restrict access to the affected endpoints until a verified patch is applied.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of access control mechanisms within the GenieWords plugin's API and AJAX infrastructure. Multiple administrative actions exposed via the REST API and AJAX handlers fail to verify the capabilities or nonces of the requesting user, allowing unauthenticated remote parties to perform state-changing operations.\nThe attack flow begins with an unauthenticated attacker interacting with the plugin's insecure API endpoints. By crafting specific HTTP requests—typically POST requests targeting these misconfigured routes—an attacker can overwrite the plugin's stored configuration parameters.\nDuring this process, the attacker injects an arbitrary payload, typically containing malicious HTML or JavaScript, into a field that the plugin expects to be a legitimate configuration value. Since the backend lacks server-side validation or input sanitization, the malicious input is persisted directly into the WordPress database.\nThe secondary phase of the exploit occurs when the plugin retrieves these stored values for front-end presentation. The plugin performs a decoding operation on the stored data before echoing it into the HTML document structure of the public-facing pages. Because the application fails to utilize context-aware output encoding (such as esc_js or esc_html), the browser interprets the attacker's script as executable code rather than plain text.\nThis behavior results in persistent, stored Cross-Site Scripting (XSS). The script executes in the context of any user who visits the affected front-end pages, including privileged administrative accounts if they view the site. This allows the attacker to steal session cookies, perform actions on behalf of the logged-in user (Cross-Site Request Forgery), or redirect legitimate traffic to malicious domains.\nAffected versions are limited to 1.5.27 to 1.5.34. The vulnerability is characterized by a complete lack of authentication requirements and network-accessible exposure, as these endpoints are reachable via standard HTTP(S) requests from any remote origin."
}