Executive Summary
CVE-2026-82923 is a critical missing authorization flaw in the AI Website Builder WordPress plugin's GitHub-distributed build. The plugin's REST API routes perform no authorization or nonce check whatsoever, allowing any unauthenticated visitor to install and activate arbitrary plugins and themes, import remote content from an attacker-controlled URL, write attacker-chosen files into the uploads directory, and delete existing site content and media.
CVSS Score: 9.8 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
On any host that executes PHP from the uploads directory, the arbitrary file-write capability is a direct path to remote code execution. No credentials, prior session, or user interaction are required — an attacker only needs network access to the site.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-82923 |
| CVSS Score | 9.8 (Critical) |
| CWE | CWE-862 — Missing Authorization |
| Affected Component | AI Website Builder plugin REST API routes |
| Affected Versions | 1.0.0 and earlier (GitHub build only) |
| Assigner | WPScan |
| Reserved | 2026-08-31 |
| Published | 2026-09-04 |
Note the scope: the vulnerability is specific to the GitHub-distributed build of AI Website Builder. The official WordPress.org repository release of the plugin is unaffected by this advisory.
Technical Details
The plugin exposes several REST API endpoints intended for site setup and content management. None of these routes validate the caller's identity or check a WordPress nonce before executing privileged actions. As a result, an unauthenticated attacker who can reach the site over the network can send crafted requests directly to these routes and have the plugin perform, on their behalf:
- Plugin and theme installation/activation — pulling arbitrary code onto the site and enabling it
- Remote content import — importing content from a URL the attacker controls, which can be used to seed malicious pages or scripts
- Arbitrary file write to the uploads directory — the attacker chooses both the filename and contents
- Deletion of site content and media — a straightforward denial-of-service / defacement path
The most severe consequence is the arbitrary file write. WordPress installations that allow PHP execution inside wp-content/uploads/ (a common misconfiguration, though not the platform default) turn this file write directly into unauthenticated remote code execution — the attacker simply writes a PHP web shell to a predictable path and requests it.
Because none of these routes require a nonce or authentication header, exploitation is trivial to automate: a single unauthenticated HTTP request against a REST route is sufficient to trigger each capability.
Impact of Successful Exploitation
| Impact | Description |
|---|---|
| Remote Code Execution | File write to uploads + PHP execution on uploads = full server-side code execution |
| Full Site Takeover | Arbitrary plugin/theme installation gives an attacker persistent, code-level control |
| Content Destruction | Attacker can delete existing site content and media outright |
| Malicious Content Injection | Remote import functionality can seed the site with attacker-controlled pages |
| No Authentication Barrier | Any visitor with network access can trigger every capability above |
Patch Status
No patched version of the plugin is currently available. There is no fixed release to upgrade to as of this advisory.
Immediate Remediation
- Uninstall the plugin immediately on any WordPress installation running the GitHub build of AI Website Builder — do not wait for a patch.
- Manually verify removal of any must-use plugin files or configuration the plugin may have dropped outside the normal plugin directory.
- Block the plugin's REST API routes at the WAF or web-server level as an interim measure if immediate removal isn't possible.
- Audit the uploads directory and site content for unauthorized files, especially PHP files, and for unexpected content changes or deletions.
- Disable PHP execution in the uploads directory (
wp-content/uploads/) as a general hardening step — this blunts the RCE impact of this and similar file-write vulnerabilities regardless of the affected plugin.
Detection Indicators
| Indicator | Description |
|---|---|
Unexpected PHP files in wp-content/uploads/ | Strong signal of exploitation via the file-write primitive |
| Unfamiliar plugins or themes suddenly installed/activated | Sign the plugin-install route was abused |
| Unexplained content deletions or media loss | Sign the content-deletion route was abused |
| REST API access log entries hitting AI Website Builder routes from unrecognized IPs, without authentication | Exploitation attempt, successful or not |