SiteGround AI Agent CVE-2026-17153

Exploitation requires the sg-ai-studio plugin to be installed and active on the target WordPress site. The primary attack path requires at least Contributor-level authenticated access to the WordPress instance in order to obtain the sg_ai_studio_gutenberg_nonce, which is emitted only to users with block editor access. The officially assigned CVSS PR:N implies an unauthenticated path may also exist; this is not fully explained in the available description and should be verified with the vendor. Exploitation is limited to image uploads to the WordPress media library - it does not enable arbitrary file type uploads, code execution, or access to existing content. Sites with no Contributor (or higher) user accounts, or with the sg-ai-studio plugin deactivated, are not exploitable.

The official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) rates this as network-exploitable with no privileges required. However, there is a tension in the data: the description states the required nonce is emitted only to users with block editor access - a group that requires at least Contributor-level authentication - which would imply PR:L rather than PR:N. The unauthenticated exploitation path is asserted by the CVE description but the mechanism is not explicitly detailed; it may rely on the nonce being accessible via a public endpoint or page source. This ambiguity should be verified against the vendor advisory and source code at the referenced trac URLs. Impact is constrained to media library write access (I:L), with no confidentiality or availability consequences. No EPSS data was provided; no CISA KEV listing exists; no public exploit code is known. Real-world prioritization should be moderate: the capability restriction being bypassed (upload_files for Contributors) is a low-severity boundary, and exploitation produces no code execution or data exfiltration. Sites running multi-author WordPress installations with Contributor accounts face slightly elevated risk.

A Contributor-level user on a multi-author WordPress site loads the Gutenberg block editor, receives the sg_ai_studio_gutenberg_nonce in the page context, and submits a crafted REST API request to the plugin's image-upload endpoint including that nonce. Because the endpoint verifies the nonce but omits the upload_files capability check, the image is accepted and added to the shared media library - content a Contributor is normally prohibited from uploading. No public proof-of-concept code has been identified at time of analysis, but the attack requires only standard HTTP tooling and knowledge of the endpoint path.