Wordfence: SiteGround AI Agent Missing Authorization Arbitrary Media Upload via REST Endpoint (CVE-2026-17153)

Vulnerability Overview Vulnerability Name: AI Agent by SiteGround <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint CVE ID: CVE-2026-17153 CVSS Score: 5.3 (Medium) Published Date: August 19, 2026 Last Updated: August 20, 2026 Researchers: Wordfence PRISM - Wordfence Affected Versions Affected Versions: AI Agent by SiteGround <= 1.2.7 Vulnerability Type: Authorization Bypass Description: The AI Agent by SiteGround plugin for WordPress contains an authorization bypass vulnerability affecting all versions up to and including 1.2.7. This vulnerability arises from the plugin's failure to correctly verify whether a user is authorized to perform specific actions, allowing unauthenticated attackers to upload images to the WordPress media library, thereby bypassing capability restrictions. While Contributor-level users are typically limited by endpoint nonces and permission checks, the is issued by the endpoint to any user with access to the block editor—including Contributors—making the missing check the sole barrier to exploitation. Remediation Fixed Version: Update to version 1.2.8 or later patched version Patch Status: Patched Additional Information References: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Share Options Facebook X (Twitter) LinkedIn Email Disclaimer This record contains copyrighted material. Copyright: 2012-2026 Defiant Inc. and 1999-2026 The MITRE Corporation. Contact To add information or report errors, please contact: wfsupport@wordfence.com Business Hours 9am-4pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays). Customers with support access receive 24/7/365 support with a 1-hour response time. Terms of Service Terms of Service, Privacy Policy, and Do Not Sell or Share My Personal Information. Products and Support Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News and About News: - Blog - News - Vulnerability Alerts About: - About Wordfence - Affiliate Program - Careers - Contact - Security - CVE Request Form Subscribe for Updates Register to receive news and updates from experienced security professionals. Email input field and subscribe button. Copyright © 2012-2026 Defiant Inc. All Rights Reserved. Miscellaneous Wordfence Intelligence: - Software Type: Plugin - Software Slug: sg-ai-studio (View on wordpress.org) - Patched: Yes - Fix: Update to version 1.2.8 or later patched version - Affected Versions: <= 1.2.7 - Patched Version: 1.2.8 Summary Vulnerability Overview: The AI Agent by SiteGround plugin contains an authorization bypass vulnerability that allows unauthenticated attackers to upload media files. Affected Versions: Affects versions <= 1.2.7. Remediation: Update to version 1.2.8 or later patched version.

Goal Reached Thanks to every supporter — we hit 100%!

Wordfence: SiteGround AI Agent Missing Authorization Arbitrary Media Upload via REST Endpoint (CVE-2026-17153)

More from this source