CVE-2026-82923General

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into the uploads directory, and delete site content and media. On a host that serves PHP from the uploads directory, that file write is remote code execution.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://wpscan.com/vulnerability/663e7004-1cca-4c0f-8d54-7298d40fe179/

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

3 mentions across 3 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
General: 2 classified signals
Disclosure: 1 classified signal
Peaked 2d ago at 1 mentions (2026-09-04); latest day: 1
3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d

Signal classification2 categories

General

266.7%

Disclosure

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-04	1	General1
2026-09-08	1	General1
2026-09-11	1	Disclosure1

Full discourse3 posts

SecAlerts@SecAlertsCo39d
Disclosure
🔓 WordPress AI Website Builder plugin has zero auth on REST routes — CVE-2026-82923 lets unauthenticated attackers install arbitrary plugins. CVSS 9.8. Remove this GitHub build now. #cybersecurity #wordpress #vulnerabilities #ciso https://secalerts.co/vulnerability/CVE-2026-82923?utm_campaign=x https://t.co/f8MtcSd7DL
Post summary
The tweet announces CVE‑2026‑82923 in the WordPress AI Website Builder plugin, detailing its high severity (CVSS 9.8) and the fact that attackers can install arbitrary plugins via unauthenticated REST routes, and urges removal of the unpatched GitHub build.
0000075
889 followersView on X
Cybersecurity News DE@cybsecuritynews42d
General
#schwachstellen CVE-2026-82923: WooCommerce-Plugin mit über 7 Millionen Installationen potenziell angreifbar #cve202682923 #theaiwebsitebuilderwordpressplugin #woocommerce #wordpressplugin https://cybersecurity-news.de/cve-2026-82923-woocommerce-plugin-7-millionen-installationen
Post summary
The tweet merely flags a potential vulnerability in a popular WooCommerce plugin with no supporting technical details, PoC, or evidence of exploitation.
0000030
12 followersView on X
CVE@CVEnew46d
General
CVE-2026-82923 The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attack… https://www.cve.org/CVERecord?id=CVE-2026-82923
Post summary
The post describes a denial of authorization in the AI Website Builder WordPress plugin, confirming the vulnerability but providing no evidence of exploitation, PoC, or patch.
000001.2K
58.1K followersView on X

Explore more

Back to dashboard