Vulnerability in Genolve WordPress Plugin Allows Privilege Escalation

A critical vulnerability, tracked as CVE-2026-1359, has been identified in the Genolve - AI image AI video generation plugin for WordPress, affecting all versions up to and including 5.0.5. The flaw stems from a missing capability check within the genolve_setOpt() function, which is designed to set various plugin options. This oversight allows authenticated attackers with Contributor-level access or higher to bypass intended security controls and modify arbitrary WordPress options. Specifically, an attacker can leverage this vulnerability to enable user registration and set the default role for new users to 'administrator', directly leading to privilege escalation and potential site compromise. This vulnerability poses a significant risk to WordPress sites utilizing the affected Genolve plugin, as it allows less privileged users to gain full administrative control.

Attack Chain

1. An authenticated attacker, possessing Contributor-level privileges or higher, logs into the vulnerable WordPress site.
2. The attacker crafts a malicious HTTP POST request targeting the WordPress AJAX endpoint (/wp-admin/admin-ajax.php).
3. The request includes parameters to invoke the genolve_setOpt action.
4. The attacker manipulates request parameters, specifically option_name and option_value, to enable users_can_register and set default_role to administrator.
5. Due to the missing capability check in the genolve_setOpt() function, the plugin processes these changes without proper authorization.
6. WordPress site options are updated, allowing new users to register with administrator privileges or an existing lower-privileged account to be elevated.
7. The attacker can then register a new administrator account, gaining full control over the WordPress site.

Impact

Successful exploitation of CVE-2026-1359 grants authenticated attackers, even those with low-privileged Contributor roles, full administrative control over the affected WordPress site. This leads to complete compromise of the website, including data manipulation, defacement, content injection, and potential for further malicious activities such as malware distribution or phishing. The vulnerability has a CVSS v3.1 base score of 8.8, indicating a high severity risk. Organizations using the Genolve plugin for WordPress should consider all affected installations to be at risk of arbitrary option updates and subsequent privilege escalation if not patched.

Recommendation

• Immediately update the Genolve - AI image AI video generation plugin to a version patched against CVE-2026-1359.
• Deploy the Sigma rules in this brief to your SIEM to detect attempts to exploit CVE-2026-1359 by monitoring webserver logs for suspicious genolve_setOpt calls.
• Monitor WordPress webserver access logs for anomalous requests to /wp-admin/admin-ajax.php containing action=genolve_setOpt combined with suspicious option_name and option_value parameters.
• Regularly review WordPress user accounts and their assigned roles to identify any unauthorized privilege escalations.