Privilege Escalation in Genolve WordPress Plugin

Executive Summary

The Genolve AI image and video generation plugin for WordPress has a vulnerability due to a missing capability check in the genolve_setOpt() function in all versions up to 5.0.5.

This flaw allows authenticated users with Contributor-level access or higher to modify arbitrary WordPress options without proper authorization.

Specifically, attackers can enable user registration and set the default user role to administrator, which leads to privilege escalation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts by allowing attackers with relatively low privileges (Contributor-level) to escalate their privileges to administrator.

Once escalated, attackers can gain full control over the WordPress site, including modifying settings, adding or removing users, and potentially deploying malicious content.

This can lead to data compromise, site defacement, unauthorized access, and disruption of services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows authenticated attackers with Contributor-level access and above to modify arbitrary WordPress options, including enabling user registration and setting the default role to administrator, which results in privilege escalation.

Such unauthorized privilege escalation and potential unauthorized access to sensitive data could lead to violations of common standards and regulations like GDPR and HIPAA, which require strict access controls and protection of personal and sensitive information.

Useful 0 Not Useful 0