AI Website Builder WordPress Plugin: Unauthenticated RCE via Missing Authorization

Executive Summary

CVE-2026-82923 is a critical missing authorization flaw in the AI Website Builder WordPress plugin's GitHub-distributed build. The plugin's REST API routes perform no authorization or nonce check whatsoever, allowing any unauthenticated visitor to install and activate arbitrary plugins and themes, import remote content from an attacker-controlled URL, write attacker-chosen files into the uploads directory, and delete existing site content and media.

CVSS Score: 9.8 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

On any host that executes PHP from the uploads directory, the arbitrary file-write capability is a direct path to remote code execution. No credentials, prior session, or user interaction are required — an attacker only needs network access to the site.

Vulnerability Overview

Note the scope: the vulnerability is specific to the GitHub-distributed build of AI Website Builder. The official WordPress.org repository release of the plugin is unaffected by this advisory.

Technical Details

The plugin exposes several REST API endpoints intended for site setup and content management. None of these routes validate the caller's identity or check a WordPress nonce before executing privileged actions. As a result, an unauthenticated attacker who can reach the site over the network can send crafted requests directly to these routes and have the plugin perform, on their behalf:

• Plugin and theme installation/activation — pulling arbitrary code onto the site and enabling it
• Remote content import — importing content from a URL the attacker controls, which can be used to seed malicious pages or scripts
• Arbitrary file write to the uploads directory — the attacker chooses both the filename and contents
• Deletion of site content and media — a straightforward denial-of-service / defacement path

The most severe consequence is the arbitrary file write. WordPress installations that allow PHP execution inside wp-content/uploads/ (a common misconfiguration, though not the platform default) turn this file write directly into unauthenticated remote code execution — the attacker simply writes a PHP web shell to a predictable path and requests it.

Because none of these routes require a nonce or authentication header, exploitation is trivial to automate: a single unauthenticated HTTP request against a REST route is sufficient to trigger each capability.

Impact of Successful Exploitation

Patch Status

No patched version of the plugin is currently available. There is no fixed release to upgrade to as of this advisory.

Immediate Remediation

1. Uninstall the plugin immediately on any WordPress installation running the GitHub build of AI Website Builder — do not wait for a patch.
2. Manually verify removal of any must-use plugin files or configuration the plugin may have dropped outside the normal plugin directory.
3. Block the plugin's REST API routes at the WAF or web-server level as an interim measure if immediate removal isn't possible.
4. Audit the uploads directory and site content for unauthorized files, especially PHP files, and for unexpected content changes or deletions.
5. Disable PHP execution in the uploads directory (wp-content/uploads/) as a general hardening step — this blunts the RCE impact of this and similar file-write vulnerabilities regardless of the affected plugin.

Detection Indicators

References

• IONIX Threat Center — CVE-2026-82923
• NIST NVD — CVE-2026-82923
• THREATINT — CVE-2026-82923