CVE-2026-82923 Details

A remote code execution vulnerability has been identified in the AI Website Builder WordPress plugin, specifically in version 1.0.0 of the GitHub build. The vulnerability arises because the plugin's REST API routes lack proper authorization and nonce checks. This oversight allows unauthenticated attackers to exploit these routes to install and activate plugins and themes, import content from a controlled URL, write arbitrary files to the uploads directory, and delete site content and media. Notably, if the uploaded file is executed as PHP, this could lead to remote code execution.

To address this vulnerability, the AI Website Builder WordPress plugin must be removed. However, simply deactivating the plugin is insufficient, as it installs a must-use plugin that remains active even after the main plugin is deactivated. This must-use plugin, along with the option holding the script URL, must be manually deleted to fully mitigate the issue.