CVE-2026-1359 Overview
CVE-2026-1359 affects the Genolve AI image and video generation plugin for WordPress. The vulnerability stems from a missing capability check in the genolve_setOpt() function across all versions up to and including 5.0.5. Authenticated attackers holding Contributor-level access or higher can update arbitrary WordPress options. Attackers can enable user registration and set the default role to administrator, achieving full privilege escalation on the target site. The flaw is classified under CWE-863: Incorrect Authorization.
Critical Impact
A Contributor-level user can escalate to administrator by manipulating WordPress core options through the unprotected genolve_setOpt() function.
Affected Products
- Genolve – AI image AI video generation plugin for WordPress
- All versions up to and including 5.0.5
- WordPress installations with the genolve-toolkit plugin active
Discovery Timeline
- 2026-07-11 - CVE-2026-1359 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-1359
Vulnerability Analysis
The Genolve plugin exposes an AJAX or admin-facing handler that invokes the genolve_setOpt() function to update plugin configuration. The function directly calls WordPress option update routines without validating the caller's capabilities. Because WordPress option storage is a shared key-value store, any writable option name reachable through this handler is exposed to modification.
An attacker authenticated as a Contributor can invoke the endpoint and overwrite security-relevant options such as users_can_register and default_role. Setting default_role to administrator and enabling registration creates a path for the attacker to register a new account with full administrative privileges.
Root Cause
The root cause is a missing current_user_can() capability check inside genolve_setOpt(). WordPress security guidance requires plugin functions that mutate state to verify both a nonce and an appropriate capability such as manage_options. The vulnerable handler enforces neither authorization gate, treating any authenticated session as authorized to configure the plugin.
Attack Vector
Exploitation requires network access and a valid Contributor-level account. The attacker sends a crafted request to the plugin endpoint that triggers genolve_setOpt() with parameters overwriting sensitive WordPress options. After enabling registration and elevating the default role, the attacker registers a new administrator account and gains full control of the site.
The fix appears in the WordPress plugin changeset, which introduces the missing authorization enforcement. Additional technical detail is available in the Wordfence Vulnerability Report.
No verified exploit code is publicly available. See referenced advisories for technical details.
Detection Methods for CVE-2026-1359
Indicators of Compromise
- Unexpected changes to the users_can_register and default_role WordPress options
- New administrator accounts created shortly after Contributor-level logins
- POST requests from Contributor sessions to Genolve plugin AJAX endpoints invoking genolve_setOpt
- Modifications to wp_options rows without corresponding administrator audit trail entries
Detection Strategies
- Audit wp_options for unauthorized changes to registration, role, and site URL keys
- Correlate Contributor account activity with WordPress option update events in web server logs
- Alert on any HTTP request containing action=genolve_setOpt originating from non-administrator sessions
- Review newly created user accounts and their assigned roles against expected onboarding workflows
Monitoring Recommendations
- Enable WordPress audit logging to capture option changes, user registrations, and role assignments
- Forward WordPress and web server logs to a centralized SIEM for correlation across sessions
- Monitor for administrator account creation events immediately following plugin AJAX activity
- Track plugin version inventory across WordPress deployments to identify hosts still on 5.0.5 or earlier
How to Mitigate CVE-2026-1359
Immediate Actions Required
- Update the Genolve plugin to a version later than 5.0.5 that includes the capability check fix
- Review all WordPress user accounts and remove any unrecognized administrators
- Verify users_can_register and default_role reflect intended configuration values
- Rotate credentials and session tokens for any accounts that may have been compromised
Patch Information
The vendor addressed the flaw in the plugin changeset referenced in the WordPress plugin repository. The patched code introduces the missing current_user_can() authorization check inside genolve_setOpt(), restricting option updates to users with the required administrative capability.
Workarounds
- Deactivate and remove the Genolve plugin until the patched version is deployed
- Restrict Contributor-level account provisioning and audit existing Contributor users
- Deploy a web application firewall rule blocking requests to the vulnerable AJAX action from non-administrator sessions
- Enforce multi-factor authentication on all WordPress accounts to raise the cost of credential-based exploitation
# Disable the vulnerable plugin via WP-CLI until patched
wp plugin deactivate genolve-toolkit
wp plugin delete genolve-toolkit
# Verify sensitive options have not been tampered with
wp option get users_can_register
wp option get default_role
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
