AI Website Builder EUVD-2026-70990

No authentication, user interaction, or special privileges are required - the CVSS vector is AV:N/AC:L/PR:N/UI:N and the description confirms the REST routes lack any authorisation or nonce check, so exploitation works remotely against default configurations of the AI Website Builder plugin (GitHub build 1.0.0). The immediately-code-executing paths (unauthenticated install/activate of a malicious plugin or theme) require no further conditions. The specific 'arbitrary file write → RCE' variant additionally requires that the host serves/executes PHP from the wp-content/uploads directory; where uploads execution is disabled, that particular path degrades to arbitrary file write rather than direct RCE, though the plugin-install path still yields full compromise. The main limiting factor on real-world scale is that this is a GitHub-distributed build rather than a WordPress.org release, so few sites are likely to run it.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) is well supported by the description: the attack is remote, requires no authentication, no user interaction, and low complexity, and the impact spans confidentiality (content import/read paths), integrity (arbitrary plugin/theme install, file write, content deletion), and availability (media/content deletion). The 9.8 is defensible even discounting the conditional uploads-PHP RCE, because unauthenticated plugin/theme installation is by itself a full compromise. No EPSS score, KEV listing, or POC was provided; there is no public exploit identified at time of analysis, and it is not in CISA KEV, so exploitation is currently theoretical-but-trivial rather than confirmed in the wild. The single-source WPScan advisory and the fact that this is a GitHub build (not the official WordPress.org distribution) mean real-world exposure is likely limited, which tempers urgency relative to a widely-installed plugin despite the maximal CVSS.

An attacker discovers a WordPress site running the plugin and sends an unauthenticated request to one of its REST routes to install and activate a malicious plugin, or to write a PHP webshell into wp-content/uploads. On a host that serves PHP from uploads, the attacker then requests that file to execute arbitrary code as the web server user; otherwise the installed malicious plugin executes on the next page load. No POC is referenced, but the attack requires only crafted HTTP requests with no credentials.