CVE-2026-82923: AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes
The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into the uploads directory, and delete site content and media. On a host that serves PHP from the uploads directory, that file write is remote code execution.
Affected Software
Event History
Frequently Asked Questions
When does the file-write issue become remote code execution?
Remote code execution occurs when the affected host is configured to serve PHP files from the WordPress uploads directory. An unauthenticated attacker can write a file of their choosing there, so environments that execute uploaded PHP are directly exposed to RCE.
Does exploitation require a WordPress account or user interaction?
No. The affected REST API routes lack both authorization and nonce checks, so an unauthenticated attacker can invoke them without credentials or user interaction.
What actions can an attacker perform even if PHP is not served from uploads?
An unauthenticated attacker can install and activate plugins and themes, import content from an attacker-controlled URL, write an arbitrary file into the uploads directory, and delete site content and media. These actions can still lead to site compromise or destructive impact even where the file write does not execute as PHP.
How can I determine whether the highest-impact condition applies to my site?
Check whether your web host executes or serves PHP files located in the WordPress uploads directory. If PHP is executable from that directory and the GitHub build version 1.0.0 is installed, the arbitrary file-write capability can be used for remote code execution.