Ai Agent By Siteground
Monthly
Unauthorized file upload in the AI Agent by SiteGround WordPress plugin (all versions through 1.2.7) allows attackers to inject arbitrary images into the WordPress media library by exploiting a missing upload_files capability check in the plugin's REST API endpoint. The endpoint's nonce (sg_ai_studio_gutenberg_nonce) is broadcast to all users with block editor access - including Contributors - making the absent capability check the sole enforcement barrier. No public exploit has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects limited integrity impact with no confidentiality or availability consequence.
Unauthorized file upload in the AI Agent by SiteGround WordPress plugin (all versions through 1.2.7) allows attackers to inject arbitrary images into the WordPress media library by exploiting a missing upload_files capability check in the plugin's REST API endpoint. The endpoint's nonce (sg_ai_studio_gutenberg_nonce) is broadcast to all users with block editor access - including Contributors - making the absent capability check the sole enforcement barrier. No public exploit has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects limited integrity impact with no confidentiality or availability consequence.