CVE-2026-82923

CRITICAL9.8

AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes

Published Sep 4, 2026

Modified Today

Details

The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into the uploads directory, and delete site content and media. On a host that serves PHP from the uploads directory, that file write is remote code execution.

References

DETECTION

https://wpscan.com/vulnerability/663e7004-1cca-4c0f-8d54-7298d40fe179/

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-82923

CVSS Analysis

CVSS v3.1

9.8

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

9.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Ecosystems

Timeline

PublishedSep 4, 2026

ModifiedSep 4, 2026