Auth bypass in Ai Website Builder (GitHub Build)

CVE-2026-82923

The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into the uploads directory, and delete site content and media. On a host that serves PHP from the uploads directory, that file write is remote code execution.

Vulnerability class: Broken Access Control

Published · last modified .

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.008 (56.7th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 57th percentile — 56.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-82923: held from 0.006 to 0.008.

EPSS over last 30 days · oldest: 0.006 · newest: 0.008 · change: +0.003

Affected products

  • Ai Website Builder (GitHub Build)

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-82923?
CVE-2026-82923 is a critical-severity vulnerability in Ai Website Builder (GitHub Build), classified under Missing Authorization. CVSS score: 9.8/10. Published 2026-09-04.
How severe is CVE-2026-82923?
Critical severity. CVSS v3 base score is 9.8 out of 10.