The GenieWords WordPress plugin is vulnerable to unauthenticated configuration overwrite and stored cross-site scripting (XSS), posing a critical risk of arbitrary code execution.

The plugin lacks authorization checks on specific REST API and AJAX actions. This allows unauthenticated attackers to modify plugin configurations and inject malicious scripts that execute on front-end pages.

This vulnerability carries a CVSS score of 8.8, indicating high severity. Successful exploitation allows an attacker to inject scripts that could lead to session hijacking, unauthorized administrative actions, or the defacement of the website. Such incidents can result in significant reputational damage and the compromise of sensitive site data.

Immediate Action: Immediately deactivate or remove the GenieWords plugin until a verified patch is released by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous requests directed at REST API or AJAX endpoints, particularly those originating from unauthorized sources.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block malicious payloads associated with cross-site scripting (XSS) and unauthorized configuration changes.

Public Exploit Available: No

Due to the critical nature of this vulnerability and the potential for full site compromise, administrators must prioritize the removal or restriction of the GenieWords plugin. Maintain vigilance for vendor updates and apply the latest security patches immediately upon availability to remediate the underlying authorization and encoding flaws.