What is the CVSS score of EUVD-2026-59869?

EUVD-2026-59869 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Kubio AI Page Builder EUVD-2026-59869

| CVE-2026-16779 MEDIUM

Missing Authorization (CWE-862)

2026-08-16 Wordfence

GHSA-mxh6-wmv3-9hg9

WordPress Authentication Bypass Kubio Ai Page Builder Wordpress Plugin Extendthemes

4.3

CVSS 3.1 · Vendor: Wordfence

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate as WordPress Contributor
Delivery

Load block editor, extract nonce from window.kubioUtilsData
Exploit

Craft AJAX request with harvested nonce targeting privileged Kubio actions
Execution

Overwrite show_on_front and page_on_front options
Persist

Rewrite navigation menus and replace template parts
Impact

Site homepage and navigation defaced without admin credentials

Vulnerability Assessment

Weakness	CWE CWE-862 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Authorization checks on every request MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires a valid WordPress account with at minimum Contributor-level role on the target installation. The Kubio AI Page Builder plugin must be installed, active, and running version 2.8.5 or earlier. The attacker must be able to load the WordPress block editor (accessible to Contributors by default) in order to read the AJAX nonce from window.kubioUtilsData. Impact is bounded to integrity of front-page configuration (show_on_front, page_on_front, page_for_posts), primary navigation menu items, template parts, and the Kubio global-data post - no confidentiality or availability impact applies. Sites where all Contributor accounts belong to trusted personnel are not practically exploitable despite the vulnerability being present.
Impact	The CVSS 4.3 (Medium) score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N accurately reflects the constrained impact: integrity only, scoped to site configuration, requiring Contributor-level authentication. Despite the moderate score, real-world impact is more disruptive than I:L implies - homepage hijacking and navigation rewriting are visible, functional attacks that can undermine site trust and user experience. The AC:L rating is well-justified because the nonce is trivially harvestable simply by loading the block editor with a Contributor account. No KEV listing and no EPSS data were provided in the available intelligence, meaning systematic exploitation has not been confirmed by CISA. The Wordfence advisory and Trac changeset (revision 3633801) indicate a patch has been committed. Practical risk is bounded by the requirement for a registered Contributor account - sites with no untrusted Contributors face negligible exposure despite the flaw's presence.
Exploit ScenarioDerived	A registered Contributor on a WordPress site running Kubio AI Page Builder ≤2.8.5 logs in, loads the block editor to extract the nonce from window.kubioUtilsData, then sends crafted AJAX requests using that nonce to overwrite show_on_front and page_on_front options - redirecting the site homepage to an attacker-chosen page. The attacker can simultaneously rewrite the primary navigation menu and replace template parts, producing site-wide visual defacement without requiring Administrator or Editor credentials.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 16, 2026

Authorization bypass in Kubio AI Page Builder (WordPress plugin, all versions ≤2.8.5) enables any authenticated Contributor to overwrite front-page configuration options, rewrite primary navigation menus, replace template parts, and overwrite the plugin's global-data post. The plugin emits the AJAX nonce unconditionally into the JavaScript global window.kubioUtilsData for every user who can load the block editor - including Contributors - making the check_ajax_referer() call a non-functional authorization barrier. No public exploit identified at time of analysis, but the exploitation mechanism is fully documented in the Wordfence advisory and the vulnerable code paths are publicly visible in the WordPress plugin Trac repository.

RemediationAI

Update the Kubio AI Page Builder plugin to the latest available version beyond 2.8.5 immediately via the WordPress admin dashboard (Plugins > Updates); the upstream fix is confirmed in Trac changeset revision 3633801 at https://plugins.trac.wordpress.org/changeset?reponame=&old=3633801%40kubio&new=3633801%40kubio, though the specific patched release version number is not independently confirmed from the available data. As a compensating control if an immediate update is not possible, restrict the Contributor role to only fully trusted users - this eliminates the exploitation path entirely since Contributor-level access is a hard prerequisite. Alternatively, temporarily deactivating the Kubio AI Page Builder plugin prevents exploitation with the trade-off of disabling the page builder functionality. Do not rely on the existing check_ajax_referer() mechanism as a security control in unpatched versions, as the nonce it validates is exposed to all block editor users.

Affected VersionsENISA

Kubio AI Page Builder 0 ≤2.8.5

Affected Packages

euvd kubio_ai_page_builder no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw is rooted in CWE-862 (Missing Authorization): the plugin delegates authorization entirely to a nonce check via check_ajax_referer(), but the nonce itself is unconditionally embedded into window.kubioUtilsData for every user who loads the WordPress block editor - a role available to Contributors by default. This design conflates authenticity verification (nonce) with capability verification (role/permission), providing no actual access control boundary. The vulnerable logic is traceable to lib/src/Core/KubioFrontPageRevertNotice.php (lines 25 and 151) and lib/editor-assets.php (line 411), and affected AJAX handler registration is visible in lib/kubio-block-library.php (line 197). The CPE is cpe:2.3:a:extendthemes:kubio_ai_page_builder:*:*:*:*:*:*:*:* covering all versions through 2.8.5. The impacted WordPress options - show_on_front, page_on_front, page_for_posts - directly control site homepage behavior and can produce visible defacement-level changes.

Know when Kubio Ai Page Builder gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Wordfence) PRIMARY 4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI 4.3 MEDIUM

Contributor-level auth required (PR:L) to harvest nonce via block editor; impact limited to integrity of site configuration options (I:L), no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

DescriptionCVE.org

The Kubio AI Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to overwrite front-page configuration options (show_on_front, page_on_front, and page_for_posts), rewrite primary navigation menu items, replace template parts, and overwrite the Kubio global-data post. Although a nonce check via check_ajax_referer() is present, the nonce is unconditionally emitted into window.kubioUtilsData for every user who can load the block editor, making it harvestable by any Contributor and therefore an ineffective authorization barrier.

Threat Intelligence Overview

EPSS Score

0.2%

Top 87% exploitable

Prevalence

Medium

popular WordPress page builder plugin, not universally deployed

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.