CVE-2026-82923CWE-862broken-access-control

CVE-2026-82923

Critical · published September 4, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
57.0
In the wild
Unconfirmed
What it is

The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into the uploads directory, and delete site content and media. On a host that serves PHP from the uploads directory, that file write is remote code execution.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00826 · 57.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-04T14:17Z
References (1)
https://wpscan.com/vulnerability/663e7004-1cca-4c0f-8d54-7298d40fe179/ · [email protected]
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 1%
    epss
  • 04 SEP 10:00Z
    AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes
    cvelistv5