Critical · published March 28, 2025
CVSS calls it critical at 9.8. It sits in the 99.6th percentile for exploit probability.
🚨 A Local File Inclusion vulnerability in the Kubio AI Page Builder plugin could let attackers execute arbitrary files with just a crafty request! 🔥 Think of it like a delivery driver who opens the back door of a truck to let anyone inside without checking their ID — that’s how easy it is for an attacker to access and run files on your server if this vulnerability is exploited. An attacker could potentially bypass all access controls, execute malicious PHP code, and gain access to sensitive data stored on your server. This could lead to a complete takeover of your site and catastrophic data loss!
Think of it like a delivery driver who opens the back door of a truck to let anyone inside without checking their ID — that’s how easy it is for an attacker to access and run files on your server if this vulnerability is exploited. This vulnerability exists in all versions of the Kubio AI Page Builder plugin up to and including 2.5.1, allowing unauthenticated users to include and execute arbitrary files on the server through the `thekubio_hybrid_theme_load_template` function.
An attacker could potentially bypass all access controls, execute malicious PHP code, and gain access to sensitive data stored on your server. This could lead to a complete takeover of your site and catastrophic data loss! To protect your site, patch the plugin immediately by updating to version 2.5.2 or later. Additionally, review your server configurations to restrict access to sensitive files and monitor for unusual activity. 🛡️ You can tackle this! Update your plugin and secure your site today, and you'll be one step closer to hero status! 💪✨