CVE-2026-74933: GenieWords WordPress Auth Bypass Vulnerability

CVE-2026-74933 Overview

CVE-2026-74933 affects the GenieWords WordPress plugin in versions 1.5.27 through 1.5.34. The plugin fails to enforce authorization checks on several REST API and AJAX endpoints. It also decodes stored values before rendering them to the page. Unauthenticated attackers can overwrite plugin configuration and inject arbitrary web scripts. Those scripts execute on every front-end page load for site visitors and administrators. The flaw maps to CWE-862: Missing Authorization and represents a combined broken access control and stored cross-site scripting (XSS) issue.

Critical Impact
Unauthenticated attackers can persistently inject JavaScript that runs in every visitor's browser, enabling session theft, administrator account takeover, and full site compromise.

Affected Products

GenieWords WordPress plugin version 1.5.27
GenieWords WordPress plugin versions 1.5.28 through 1.5.33
GenieWords WordPress plugin version 1.5.34

Discovery Timeline

2026-09-13 - CVE-2026-74933 published to the National Vulnerability Database (NVD)
2026-09-14 - CVE-2026-74933 last updated in NVD

Technical Details for CVE-2026-74933

Vulnerability Analysis

The GenieWords plugin exposes REST API and AJAX action handlers without verifying the caller's identity or capabilities. Any unauthenticated HTTP client can invoke these endpoints and modify plugin configuration values. The plugin then reads those stored values, decodes them, and prints the decoded output into front-end page markup without contextual escaping.

This combination turns a broken access control flaw into a stored XSS delivery channel. An attacker writes payloads once, and the payloads run on every subsequent page render. Because the injected script executes in the browser of every visitor, including logged-in administrators, the attacker can escalate to full WordPress site takeover through session cookie theft or forced administrative actions.

Root Cause

The root cause is missing authorization on privileged REST and AJAX handlers, combined with output that decodes previously stored values before printing. The plugin does not call WordPress capability checks such as current_user_can() or nonce validation via check_ajax_referer() on the affected endpoints. Decoding stored data before output negates any sanitization that WordPress storage APIs may have applied.

Attack Vector

The attack requires network access to the WordPress site and no authentication. Exploitation proceeds in two steps. First, the attacker sends a crafted request to the vulnerable REST or AJAX endpoint to overwrite a configuration value with an HTML-encoded script payload. Second, any user who loads a front-end page triggers the plugin's output routine, which decodes the payload and injects it into the DOM.

The user interaction requirement in the CVSS vector reflects the need for a victim to load a page after the payload is planted. Details of the vulnerable endpoints are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-74933

Indicators of Compromise

Unauthenticated POST requests to GenieWords REST routes under /wp-json/ or to admin-ajax.php with GenieWords action names
Unexpected <script> tags, event handlers, or encoded JavaScript stored in GenieWords configuration rows within the wp_options table
Outbound requests from visitor browsers to attacker-controlled domains originating from pages served by the WordPress site
Newly created WordPress administrator accounts or unexpected role changes following anomalous plugin traffic

Detection Strategies

Inventory WordPress installations and identify sites running GenieWords versions 1.5.27 through 1.5.34
Inspect web server access logs for anonymous requests to GenieWords AJAX actions or REST endpoints returning HTTP 200
Review GenieWords plugin option values for HTML entities, base64 blobs, or JavaScript keywords such as onerror, onload, or <script

Monitoring Recommendations

Alert on unauthenticated write operations to /wp-json/ routes belonging to third-party plugins
Monitor rendered front-end HTML for injected scripts using synthetic browsing or content integrity checks
Track administrator session activity for anomalous actions such as user creation or plugin installation shortly after page loads

How to Mitigate CVE-2026-74933

Immediate Actions Required

Update the GenieWords plugin to a version above 1.5.34 that includes authorization checks and safe output handling
If no fixed version is available, deactivate and remove the GenieWords plugin from all affected sites
Audit wp_options and any plugin-specific tables for injected script content and remove malicious values
Rotate all WordPress administrator credentials and invalidate active sessions after cleanup

Patch Information

Refer to the WPScan Vulnerability Report for the fixed version and vendor advisory details. Verify the installed plugin version through the WordPress admin plugins page after applying the update.

Workarounds

Block unauthenticated requests to GenieWords REST and AJAX endpoints at a web application firewall (WAF)
Restrict access to /wp-json/ and admin-ajax.php from untrusted networks where feasible
Enforce a strict Content Security Policy (CSP) that disallows inline scripts to limit the impact of stored XSS payloads

bash

# Example nginx rule to block unauthenticated access to GenieWords AJAX actions
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^geniewords_") {
        return 403;
    }
}