What is the CVSS score of CVE-2026-16779?

CVE-2026-16779 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Kubio AI Page Builder CVE-2026-16779

EUVD-2026-59869 MEDIUM

Missing Authorization (CWE-862)

2026-08-16 Wordfence

GHSA-mxh6-wmv3-9hg9

WordPress Authentication Bypass Kubio Ai Page Builder Wordpress Plugin Extendthemes

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Contributor-level auth required (PR:L) to harvest nonce via block editor; impact limited to integrity of site configuration options (I:L), no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 16, 2026 - 05:12 vuln.today

CVE Published

Aug 16, 2026 - 04:24 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Kubio AI Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to overwrite front-page configuration options (show_on_front, page_on_front, and page_for_posts), rewrite primary navigation menu items, replace template parts, and overwrite the Kubio global-data post. Although a nonce check via check_ajax_referer() is present, the nonce is unconditionally emitted into window.kubioUtilsData for every user who can load the block editor, making it harvestable by any Contributor and therefore an ineffective authorization barrier.

AnalysisAI

Authorization bypass in Kubio AI Page Builder (WordPress plugin, all versions ≤2.8.5) enables any authenticated Contributor to overwrite front-page configuration options, rewrite primary navigation menus, replace template parts, and overwrite the plugin's global-data post. The plugin emits the AJAX nonce unconditionally into the JavaScript global window.kubioUtilsData for every user who can load the block editor - including Contributors - making the check_ajax_referer() call a non-functional authorization barrier. No public exploit identified at time of analysis, but the exploitation mechanism is fully documented in the Wordfence advisory and the vulnerable code paths are publicly visible in the WordPress plugin Trac repository.

Technical ContextAI

The flaw is rooted in CWE-862 (Missing Authorization): the plugin delegates authorization entirely to a nonce check via check_ajax_referer(), but the nonce itself is unconditionally embedded into window.kubioUtilsData for every user who loads the WordPress block editor - a role available to Contributors by default. This design conflates authenticity verification (nonce) with capability verification (role/permission), providing no actual access control boundary. The vulnerable logic is traceable to lib/src/Core/KubioFrontPageRevertNotice.php (lines 25 and 151) and lib/editor-assets.php (line 411), and affected AJAX handler registration is visible in lib/kubio-block-library.php (line 197). The CPE is cpe:2.3:a:extendthemes:kubio_ai_page_builder:*:*:*:*:*:*:*:* covering all versions through 2.8.5. The impacted WordPress options - show_on_front, page_on_front, page_for_posts - directly control site homepage behavior and can produce visible defacement-level changes.

RemediationAI

Update the Kubio AI Page Builder plugin to the latest available version beyond 2.8.5 immediately via the WordPress admin dashboard (Plugins > Updates); the upstream fix is confirmed in Trac changeset revision 3633801 at https://plugins.trac.wordpress.org/changeset?reponame=&old=3633801%40kubio&new=3633801%40kubio, though the specific patched release version number is not independently confirmed from the available data. As a compensating control if an immediate update is not possible, restrict the Contributor role to only fully trusted users - this eliminates the exploitation path entirely since Contributor-level access is a hard prerequisite. Alternatively, temporarily deactivating the Kubio AI Page Builder plugin prevents exploitation with the trade-off of disabling the page builder functionality. Do not rely on the existing check_ajax_referer() mechanism as a security control in unpatched versions, as the nonce it validates is exposed to all block editor users.