External risk intelligence

AI Website Builder WordPress Plugin Unauthenticated Plugin and Content Management

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-82923

The vulnerability affects a WordPress plugin which, by design, functions as a public-facing web application. The vulnerable REST API routes are accessible over the internet as part of the normal operation of a website, making the attack surface public-facing by default.

Remote Code Execution

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE concerns a critical vulnerability in the AI Website Builder WordPress plugin that allows unauthenticated attackers to take full control of a website, including installing or activating plugins and themes, importing content, writing files, and deleting site data. In some configurations, this could lead to remote code execution, enabling attackers to run their own code on the server.

Attackers can install, delete, and control website content.
This allows for complete takeover of affected websites.
Confirm if this plugin is in use and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by accessing the website's REST API without needing any credentials. This allows them to manipulate the site by installing or activating plugins and themes, importing external content, writing files to the uploads directory, and deleting site content. If the server is configured to execute PHP files from the uploads directory, this file write capability can lead to remote code execution.

Accessible via public network.
Triggered through REST API routes.
Risk of code execution and data compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to compromise a WordPress website by installing unauthorized plugins or themes, importing malicious content, writing files to the uploads directory, and deleting site content. If the host serves PHP from the uploads directory, this could lead to remote code execution.

Website data and control.
Unauthenticated access to API routes.
Remote code execution and site compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the AI Website Builder WordPress plugin requires immediate attention from teams responsible for WordPress deployments. The first practical step is to identify all instances of this plugin, determine their reachability and criticality, and then confirm the accountable owner for remediation. Planning for updates or mitigation should be prioritized based on this inventory and risk assessment.

WordPress administrators and site owners.
Confirm plugin presence and reachability.
Plan and execute remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the AI Website Builder WordPress plugin?

The AI Website Builder WordPress plugin is a software tool designed to help users create or manage website content and layouts within a WordPress environment. It functions as an extension to the core WordPress platform, adding specialized capabilities for site construction. Because it operates within WordPress, it relies on the underlying server to host files and process data, integrating directly into the site's REST API to handle administrative tasks like content imports or plugin management.

What does CVE-2026-82923 mean for site security?

This CVE describes a failure in access control, specifically missing authorization and nonce verification. In plain terms, the plugin fails to check if a person is allowed to perform administrative tasks before executing them. Because these security checks are absent, the system treats requests from unauthenticated strangers as if they were coming from a trusted site administrator, allowing them to modify files, delete media, or install malicious plugins.

How is this vulnerability triggered?

An attacker triggers the vulnerability by sending specific requests to the plugin's REST API endpoints. Crucially, the bug is not triggered by standard site browsing; it requires the attacker to interact directly with the plugin's backend routes. If the plugin is not installed or if the specific REST API routes are disabled or blocked by other security measures, the vulnerability cannot be triggered via these paths.

Is my website at risk from this vulnerability?

Halo Surface Signal classifies this as an external threat because the vulnerable REST API routes are typically exposed to the public internet by design. If you use this plugin, your site is likely reachable by anyone online. Sites that are internal-only or protected by network-level access controls may have a reduced risk profile, but any site exposing these API endpoints to the web should be considered potentially accessible to an attacker.

What should I do if I use this plugin?

Your first step is to perform an inventory of all WordPress sites to identify if this specific plugin is installed. Once you have a list of affected instances, confirm who is responsible for each site and verify if the plugin is currently active. Prioritize these sites based on their exposure to the internet and plan to remove, disable, or update the plugin as soon as a fix is available, ensuring you have backups of your data before making changes.

References

wpscan.com/vulnerability/663e7004-1cca-4c0f-8d54-7298d40fe179/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.