AIOS WordPress Plugin EUVD-2026-34942

Exploitation requires the target site to have BOTH the AIOS option 'Disable REST API for non-logged in users' (aiowps_disallow_unauthorized_rest_requests) enabled AND debug logging (aiowps_enable_debug) enabled - neither is on by default - because the vulnerable concatenation only occurs inside the unauthenticated-REST rejection path that writes to the AIOS debug log. The injection itself is unauthenticated and remote over HTTP with no special tooling (CVSS PR:N/UI:N/AC:L), but payload execution is gated on a privileged user (a WordPress administrator) subsequently navigating to the AIOS Dashboard Debug Logs admin page, which is what the CVSS S:C scope change reflects. Limiting factors that reduce realistic risk: sites that leave AIOS at defaults, sites that use AIOS without enabling its debug logger, and sites where administrators rarely visit the AIOS Debug Logs screen are not practically exploitable.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N produces a 7.2 (High) score driven primarily by the changed scope, network reach, and lack of authentication or user interaction at the injection step - though an administrator must later visit the debug log page for the payload to fire, which the vector models as scope change rather than UI:R. EPSS and CISA KEV data are not provided in the input, so exploitation probability and active-exploitation status cannot be quantified; based on the available signals there is no public exploit identified at time of analysis. Real-world risk is meaningfully gated by configuration: both aiowps_disallow_unauthorized_rest_requests and aiowps_enable_debug must be enabled simultaneously, which is not the default for every AIOS deployment. Where those settings are enabled, however, the impact is severe because admin-context script execution in WordPress typically chains to full site compromise via nonce theft and privileged AJAX/REST calls, so this should be treated as a real priority for any site that has hardened REST access via AIOS and uses its debug logger.

On a site running AIOS 5.4.7 or earlier with both the unauthenticated REST blocker and debug logging enabled, an unauthenticated attacker sends an HTTP request to a WordPress REST endpoint with a URL-encoded JavaScript payload embedded in the request path (for example /wp-json/wp/v2/%3Cscript%3E…%3C/script%3E). The plugin decodes the path, writes it verbatim into the debug log table, and the payload lies dormant until an administrator opens the AIOS Debug Logs page, at which point the script executes in the admin's authenticated session and can steal nonces or call privileged REST/AJAX endpoints to create a new administrator account.