Kubio AI Website Builder EUVD-2026-68616

Exploitation requires a valid WordPress administrator-level session (PR:H); the attacker must fully authenticate before any exploitation attempt is possible. The attack is conducted over the network (AV:N) with no additional attack requirements (AT:N) and no user interaction beyond the attacker's own session. Available data does not identify a specific plugin feature, endpoint, or non-default configuration setting as a prerequisite - the flaw appears accessible to any authenticated admin through standard plugin functionality. Exploitation is limited by: the high-privilege requirement, which blocks unauthenticated and low-privileged exploitation entirely; and the purely availability-based impact scope (VC:N, VI:N), which rules out data theft or remote code execution pathways from this flaw alone.

The CVSS 4.0 score of 6.9 (Medium) reflects a vulnerability with meaningful but structurally constrained real-world risk. While the attack vector is network (AV:N) with low complexity and no attack requirements (AC:L, AT:N), the PR:H designation is a significant limiting factor - exploitation requires an already-authenticated WordPress administrator account, meaning an external attacker must first compromise admin credentials before triggering the flaw. No EPSS score was provided in the available data, and the vulnerability does not appear in the CISA KEV catalog and has no associated proof-of-concept, indicating no active exploitation at time of analysis. The availability-only impact profile (VA:H with VC:N and VI:N) classifies this as a denial-of-service class vulnerability with no data exfiltration or code execution pathway, further reducing its attractiveness to opportunistic threat actors. Real-world priority is moderate: organizations enforcing strong admin account hygiene - including MFA and minimal admin-role assignment - face limited additional exposure, while sites with weak or shared credentials carry greater residual risk. The 'Information Disclosure' tag in the source data conflicts with the CVSS vector and should not be relied upon for risk prioritization.

An attacker who has obtained WordPress administrator credentials - via phishing, credential stuffing, or lateral movement within a compromised environment - authenticates to the admin panel and submits specially crafted input to a Kubio AI Website Builder handler. The plugin fails to properly validate this input, triggering resource exhaustion or a fatal processing error that causes a denial-of-service condition for the WordPress site. No public proof-of-concept exploit has been identified at time of analysis.