Wordfence Advisory: GW AI Website Builder Missing Auth Arbitrary Plugin Settings Deletion (CVE-2026-1946)

Vulnerability Overview Vulnerability Name: GW AI Website Builder <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion CVE ID: CVE-2026-1946 CVSS Score: 4.3 (Medium) Release Date: July 9, 2026 Last Updated: July 10, 2026 Researcher: Legion Hunter Affected Range Software Type: Plugin Software Name: gw-ai-website-builder Affected Versions: <= 1.0.1 Fixed Version: 1.0.2 Remediation Fix: Update to version 1.0.2 or a later patched version. Vulnerability Description The GW AI Website Builder plugin contains an unauthorized data modification vulnerability within the function. This vulnerability allows authenticated attackers (with Subscriber level or higher privileges) to disconnect by invoking the GravityWrite AJAX action. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Share Options Facebook Twitter LinkedIn Email Additional Information Business Hours: 9 am–8 pm ET, 6 am–5 pm PT, and 2 pm–1 am UTC/GMT (excluding weekends and holidays) Support Service: 365 days/year, 24-hour support with a 1-hour response time Copyright Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Disclaimer Disclaimer: The content on this page is copyrighted; see the link at the bottom of the page for specific terms. Contact Email: support@wordfence.com Other Links Terms of Service: Link Privacy Policy and Notice at Collection: Link Do Not Sell or Share My Personal Information: Link Social Media Facebook: Link Twitter: Link LinkedIn: Link Instagram: Link Products and Services Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form Subscribe for Updates Subscription Form: Link Other Powered by: Link --- Note: Specific Proof of Concept (POC) code or exploit code is not included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

Wordfence Advisory: GW AI Website Builder Missing Auth Arbitrary Plugin Settings Deletion (CVE-2026-1946)

More from this source