What is the CVSS score of CVE-2026-5427?

CVE-2026-5427 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-5427

EUVD-2026-23358 MEDIUM

Missing Authorization (CWE-862)

2026-04-17 Wordfence

GHSA-69wp-qf6q-mf28

Authentication Bypass File Upload WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 17, 2026 - 04:41 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 04:30 euvd

EUVD-2026-23358

Analysis Generated

Apr 17, 2026 - 04:30 vuln.today

CVE Published

Apr 17, 2026 - 03:36 nvd

MEDIUM 5.3

DescriptionCVE.org

The Kubio plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 2.7.2. This is due to insufficient capability checks in the kubio_rest_pre_insert_import_assets() function, which is hooked to the rest_pre_insert_{post_type} filter for posts, pages, templates, and template parts. When a post is created or updated via the REST API, Kubio parses block attributes looking for URLs in the 'kubio' attribute namespace and automatically imports them via importRemoteFile() without verifying the user has the upload_files capability. This makes it possible for authenticated attackers with Contributor-level access and above to bypass WordPress's normal media upload restrictions and upload files fetched from external URLs to the media library, creating attachment posts in the database.

AnalysisAI

Kubio page builder plugin for WordPress allows authenticated attackers with Contributor-level access to upload arbitrary files from external URLs by bypassing capability checks in the REST API post creation handler. The kubio_rest_pre_insert_import_assets() function automatically imports remote files referenced in block attributes without verifying the user possesses the upload_files capability, violating WordPress's normal media upload restrictions. Affected versions are up to and including 2.7.2; no public exploit code has been identified at the time of analysis.

Technical ContextAI

The vulnerability exists in Kubio's REST API integration, specifically in the kubio_rest_pre_insert_import_assets() hook attached to rest_pre_insert_{post_type} for posts, pages, templates, and template parts. When WordPress processes a REST API request to create or update content, Kubio scans block attributes in the 'kubio' namespace for URLs and automatically invokes importRemoteFile() to fetch and import those files into the media library as attachment posts. The root cause is CWE-862 (Missing Authorization), as the function performs file operations without calling WordPress's is_user_logged_in() check or verifying the user has the upload_files capability via current_user_can('upload_files'). The affected product is identified by CPE cpe:2.3:a:extendthemes:kubio_ai_page_builder, which is the Kubio AI Page Builder plugin maintained by ExtendThemes. The REST API endpoint is the standard WordPress REST API accessible at /wp-json/wp/v2/, meaning attackers need only valid WordPress credentials at Contributor level or higher.

RemediationAI

Update Kubio AI Page Builder to version 2.7.3 or later, which patches the vulnerable kubio_rest_pre_insert_import_assets() function to properly check current_user_can('upload_files') before importing remote files. The patch is available via the WordPress plugin repository (https://plugins.trac.wordpress.org/) and can be applied by navigating to Plugins > Installed Plugins in the WordPress admin dashboard and clicking Update next to Kubio. For sites unable to immediately patch, implement a temporary workaround by restricting REST API access to Contributor and above accounts using a security plugin such as Wordfence or a hardened .htaccess rule limiting POST/PUT requests to /wp-json/wp/v2/posts, /wp-json/wp/v2/pages, /wp-json/wp/v2/wp_template, and /wp-json/wp/v2/wp_template_part endpoints to users with Edit Posts capability. Additionally, audit WordPress user roles and remove Contributor-level access from any accounts that do not require it, as Contributor is the minimum privilege level required for exploitation. Note that disabling the REST API entirely will prevent exploitation but may break other functionality depending on your WordPress configuration.