CRITICAL 9.8 NVD

CVE-2026-82923

The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated

The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into the uploads directory, and delete site content and media. On a host that serves PHP from the uploads directory, that file write is remote code execution.

References

https://wpscan.com/vulnerability/663e7004-1cca-4c0f-8d54-7298d40fe179/

Published: 2026-09-04 · Source: NVD · Feed updated: 2026-09-04

This critical severity vulnerability with a CVSS score of 9.8 was published on 2026-09-04 via NVD.

Risk Timeline

CVE Disclosed2026-09-04 · -1 days ago

Remediation Resources

Official Advisory

wpscan.com/vulnerability/663e7004-1cca-4c0f-8d54-7298d40fe179/

vulnfeed aggregates 8217 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.