GW AI Website Builder Unauth RCE via Unprotected REST Routes (CVE-2026-82923)

Key Vulnerability Information Summary Vulnerability Overview Vulnerability Name: AI Website Builder (GitHub build) 1.0.0 – Unauthenticated RCE via Unprotected REST Routes Type: Missing Authentication CVSS Score: 9.8 (Critical) CWE: CWE-862 OWASP Top 10: A5: Broken Access Control CVE: CVE-2026-82923 Scope of Impact Affected Plugin: (no known fixed version) Impact Description: - The plugin does not perform any authorization or nonce validation on its REST API routes, allowing unauthenticated attackers to install/activate plugins and themes, import content from attacker-controlled URLs, write arbitrary files to the uploads directory, and delete site content and media. - If the host serves PHP files from the uploads directory, this file write capability constitutes Remote Code Execution (RCE). - This affects only code copies published in the public GitHub repository, which installs with the slug ; the version published on wordpress.org is not affected (as its routes include an administrator capability check). - Both versions are 1.0.0 and cannot be distinguished by version number; since there is no fixed version for the GitHub copy, the mitigation is to remove the plugin. - Removing the plugin alone is insufficient: it installed a must-use plugin that will not be automatically removed upon deactivation. Scripts planted by the attacker will continue to execute on every page load, so the must-use plugin and its script URL option must also be removed. Remediation 1. Remove the plugin. 2. Also remove the must-use plugin it installed, and clear the saved script URL option to prevent the script from continuing to execute on every page load. PoC / Exploit Code The PoC section on the page displays a placeholder notice; no actual code is provided: > The PoC will be displayed once the issue has been remediated. (In other words: the PoC will only be displayed after the issue is fixed; the current screenshot contains no specific PoC code block.)

Goal Reached Thanks to every supporter — we hit 100%!

GW AI Website Builder Unauth RCE via Unprotected REST Routes (CVE-2026-82923)