# CVE-2026-57316: Roxnor GetGenie sensitive data exposure in WordPress plugin

Source: https://junglewise.ai/threats/cve-2026-57316-roxnor-getgenie-sensitive-data-exposure-in-wordpress-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-57316 · Severity: medium · CVSS 6.5 · Published 2026-06-26

GetGenie, an AI-powered content and SEO assistant for WordPress, contains a security flaw that allows users with basic 'Subscriber' accounts to access sensitive system information. This exposure could reveal internal data that is normally restricted to administrators, potentially aiding attackers in planning more sophisticated attacks against the website. Business operations may be impacted if sensitive configuration or user data is leaked, leading to further system compromise.

Vendors: [Roxnor](https://junglewise.ai/threats/vendors/roxnor).

## Quick answers

**Is CVE-2026-57316 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57316 being exploited in the wild.

**How severe is CVE-2026-57316?** Medium severity, with a CVSS score of 6.5, published 26 June 2026.

**Which products and versions are affected?** Roxnor GetGenie <= 4.4.2.

**Is there a fix for CVE-2026-57316?** A patch was published on 2026-06-26: Version 4.4.3 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57316 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57316?** Check whether you run Roxnor GetGenie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The GetGenie plugin for WordPress (versions <= 4.4.2) is vulnerable to an 'Exposure of Sensitive System Information to an Unauthorized Control Sphere' (CWE-497). The vulnerability allows a network-based attacker with low-level 'Subscriber' privileges to bypass intended access controls and view sensitive data. This occurs because the plugin does not sufficiently restrict access to certain internal data points or administrative information. An attacker can exploit this to gather intelligence for further exploitation of the host system. The issue is resolved in version 4.4.3.

## Affected products

- Roxnor GetGenie <= 4.4.2

## Timeline

- 2026-06-08: other: Reported by Fraudless
- 2026-06-26: disclosed: Published by Patchstack and NVD
- 2026-06-26: patched: Version 4.4.3 released to address the vulnerability

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/getgenie/vulnerability/wordpress-getgenie-plugin-4-4-2-sensitive-data-exposure-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/getgenie/vulnerability/wordpress-getgenie-plugin-4-4-2-sensitive-data-exposure-vulnerability?_s_id=cve)