Kubio Ai Page Builder CVE-2026-5427

Exploitation requires: (1) valid WordPress user account with Contributor-level access or higher (PR:L in CVSS terms) - exploits cannot succeed with unauthenticated access despite the published CVSS vector claiming PR:N; (2) WordPress 5.0 or later with REST API enabled (default configuration); (3) Kubio plugin installed and activated on the target site. The vulnerability is triggered when the attacker sends a REST API request via POST or PUT to create or update a post, page, template, or template part with block attributes containing URLs in the kubio namespace. Non-default configurations that disable the REST API or restrict it via authentication plugins will prevent exploitation. Additionally, WordPress installations with restrictive user role policies that do not grant Contributor access to untrusted users will significantly reduce real-world risk, though the vulnerability itself remains present in the code.

The risk assessment reveals a significant disconnect between the CVSS 5.3 score and the true severity. The published CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates network-based, unauthenticated exploitation with no user interaction required - yet the description explicitly states authentication is required and the attacker must be a Contributor or above. This vector appears incorrect or generated from incomplete data; the accurate vector should be AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (authenticated, Contributor-level PR:L), which would yield CVSS 4.3. The actual risk is moderate: exploitation requires valid WordPress credentials and Contributor-level or higher role, which significantly limits the attack surface compared to unauthenticated attacks. However, in WordPress installations with permissive user management, this is practical - many sites grant Contributor roles to content authors and freelancers. The file upload capability itself, while restricted by WordPress policy, does not immediately lead to remote code execution; the attacker must additionally trick an admin into visiting malicious files or rely on server-side processing of uploaded files. The patch availability (referenced commit 3506647) indicates the vendor has released a fix, reducing real-world risk for patched instances. KEV status is not provided in the input, suggesting no confirmed active exploitation at the time of analysis. The Wordfence reporting and detailed code references indicate thorough research and vendor coordination.

An attacker with a valid Contributor-level WordPress account (obtained through credential compromise or insider access) logs into the target site's REST API and sends a POST request to create a new post containing a block with a kubio-namespaced attribute pointing to a malicious file hosted on an attacker-controlled server (e.g., a PHP shell disguised as an image). The Kubio plugin automatically fetches this file and imports it into the media library without checking the user's upload_files capability. The malicious file is now stored in the WordPress upload directory and can potentially be executed if the attacker tricks an administrator into visiting it or if the server is configured to execute PHP in the uploads folder.