CVE-2026-82923

The AI Website Builder WordPress plugin (GitHub build) 1.0.0 performs no authorisation or nonce checks on its REST API routes (CWE-862), so any unauthenticated visitor can invoke those endpoints. An attacker can install and activate arbitrary plugins and themes, import content from a URL under their control, write an attacker-chosen file into the uploads directory, and delete existing site content and media. On hosts that execute PHP files stored in the uploads directory, that arbitrary file write escalates to full remote code execution; even where PHP is not executed in uploads, the attacker can establish persistence via an installed plugin/theme or vandalise the site. Any WordPress site running version 1.0.0 of this plugin is affected, and the flaw is rated critical (CVSS 3.1: 9.8); the plugin's GitHub-build distribution suggests a limited but unquantified installed base. No public proof-of-concept or confirmed in-the-wild exploitation is known, and EPSS estimates a 0.6% probability of exploitation within 30 days (45th percentile).

What to do: Deactivate or remove the plugin, or update to the latest patched release from its GitHub source as soon as one is published (only 1.0.0 is documented as vulnerable, so no fixed version number is available in this data). As interim mitigations, disable PHP execution in wp-content/uploads and restrict unauthenticated access to the plugin's WordPress REST API routes (e.g., via WAF rules). Check sites for signs of compromise, including unexpectedly installed or activated plugins/themes, unknown files in the uploads directory, and deleted posts or media.