CVE-2026-82923: Unauthenticated RCE in AI Website Builder Plugin

Executive Summary

A critical unauthenticated vulnerability in the AI Website Builder WordPress plugin (GitHub build, version 1.0.0) allows remote attackers to install and activate plugins, write arbitrary files to the uploads directory, and potentially achieve remote code execution (RCE). Tracked as CVE-2026-82923, the flaw carries a CVSS score of 9.8 and requires no authentication, making it a prime target for mass exploitation. As of publication, no patch is available; the only reliable mitigation is to remove the plugin from any WordPress installation.

The vulnerability stems from missing authorization and nonce checks on the plugin's REST API routes. An attacker can leverage these endpoints to perform privileged actions, including installing a malicious plugin that leads to full site compromise. Given the plugin is distributed via GitHub and may be used on sites where administrators manually installed it, the exposure is significant. This article provides technical details, affected scope, and immediate remediation steps for defenders.

Technical Analysis

According to the NVD entry and the WPScan advisory, the AI Website Builder plugin version 1.0.0 fails to enforce any authorization or nonce verification on its REST API routes. This allows an unauthenticated attacker to send crafted HTTP requests to endpoints that should require administrative privileges.

The advisory lists several concrete impacts:

• Install and activate plugins and themes: An attacker can upload and activate a malicious plugin, which typically leads to arbitrary code execution.
• Import content from an attacker-controlled URL: This can be used to inject malicious content or exfiltrate data.
• Write a file of the attacker's choosing into the uploads directory: On hosts that execute PHP from the uploads directory, this directly results in remote code execution.
• Delete site content and media: The attacker can wipe pages, posts, and media files, causing data loss and defacement.

The missing nonce check is particularly concerning because WordPress REST API routes often rely on nonces to prevent cross-site request forgery (CSRF). Without them, any unauthenticated request is accepted, and with no authorization checks, the plugin effectively exposes administrative functionality to the public internet.

The vulnerability is classified as critical due to the ease of exploitation and the potential for full site takeover. The CVSS 9.8 score reflects the network attack vector, low complexity, no privileges required, and no user interaction needed.

At this time, no technical details about the exact REST API endpoints have been publicly disclosed beyond the advisory's description. However, the attack surface is clear: any request to the plugin's REST routes can trigger these actions.

Indicators of Compromise

No specific indicators of compromise (IOCs) are available yet. Since the attack involves installing plugins or writing files, defenders should monitor for unexpected new plugins, unknown files in the uploads directory, and unusual REST API requests. Checking server logs for POST requests to the plugin's REST endpoints may reveal exploitation attempts.

Tactics, Techniques & Procedures

While no specific threat actor has been attributed, the attack pattern aligns with common WordPress exploitation tactics. The vulnerability enables the following MITRE ATT&CK techniques:

• T1190 Exploit Public-Facing Application: The attacker exploits the vulnerable REST API without authentication.
• T1505.003 Web Shell: Writing a PHP file to the uploads directory can create a web shell.
• T1059 Command and Scripting Interpreter: Once a web shell is in place, the attacker can execute arbitrary commands.

The lack of nonce and authorization checks is a classic insecure direct object reference (IDOR) / missing function-level access control issue, often seen in hastily developed plugins.

Threat Actor Context

No specific threat actor or group has been identified in connection with CVE-2026-82923. The vulnerability is likely to attract opportunistic attackers and botnets that scan for vulnerable WordPress plugins. Given the critical severity and ease of exploitation, it is plausible that exploitation attempts will begin shortly after public disclosure.

Mitigations & Recommendations

Immediate action: Since no patch is available, the only reliable mitigation is to remove the AI Website Builder plugin from any WordPress installation. If the plugin is essential for business operations, consider disabling it until a patched version is released, but note that disabling may not fully mitigate the risk if the REST routes remain registered.

Defensive measures:

• Web Application Firewall (WAF): Deploy rules to block requests to the plugin's REST API endpoints, especially those containing suspicious payloads.
• Monitor file integrity: Watch for new or modified files in the wp-content/uploads/ directory, particularly PHP files.
• Audit installed plugins: Regularly review all plugins and remove any that are not actively maintained or from untrusted sources.
• Apply the principle of least privilege: Ensure that the web server user does not have write permissions to the uploads directory if PHP execution is enabled there.

Long-term guidance: WordPress administrators should only install plugins from the official WordPress.org repository or reputable vendors that follow security best practices. Always keep plugins updated and monitor security advisories from sources like WPScan.