CVE-2026-82923: 
WordPress vulnerability analysis and mitigation

CVE-2026-82923 is a critical Missing Authorization vulnerability in the AI Website Builder WordPress plugin (GitHub build) version 1.0.0, allowing unauthenticated attackers to perform remote code execution and other destructive actions via unprotected REST API routes. The vulnerability was publicly disclosed on September 2, 2026, and assigned a CVSS v3.1 base score of 9.8 (Critical) (WPScan, GitHub Advisory). Importantly, only the GitHub-distributed build (installing as gw-website-builder-main) is affected — the wordpress.org releases under the slug gw-ai-website-builder are not vulnerable, as they gate the same routes behind an administrator capability check. Both versions carry version number 1.0.0, making them indistinguishable by version alone (WPScan).

The root cause is CWE-862 (Missing Authorization): the plugin's REST API routes perform no authorization or nonce verification, meaning any unauthenticated network request can invoke privileged functionality (WPScan, GitHub Advisory). Exploitation requires no credentials, no user interaction, and low attack complexity — an attacker simply sends crafted HTTP requests to the exposed REST API endpoints. The most severe attack path involves writing an arbitrary PHP file to the WordPress uploads directory; on servers that execute PHP from that directory (a common misconfiguration), this constitutes unauthenticated remote code execution. Additionally, the plugin installs a must-use plugin at activation that persists even after the main plugin is deactivated, meaning attacker-planted scripts continue to load on every page view after removal (WPScan).

An unauthenticated remote attacker can install and activate arbitrary plugins and themes, import malicious content from attacker-controlled URLs, write arbitrary files to the uploads directory (enabling RCE on misconfigured hosts), and delete all site content and media — resulting in full compromise of confidentiality, integrity, and availability (WPScan, GitHub Advisory). Successful RCE could allow lateral movement within the hosting environment, credential theft, and persistent backdoor installation via the must-use plugin mechanism that survives plugin deactivation (WPScan).

The NVD SSVC assessment classifies this vulnerability as automatable with total technical impact, and a proof-of-concept exists (though WPScan has withheld its public release pending remediation) (WPScan). As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation or threat actor attribution (GitHub Advisory). The EPSS score is approximately 0.57% (45th percentile), and the CVE status is listed as "Deferred" with no CISA KEV catalog entry identified. The vulnerability is not present in the wordpress.org-distributed version, which limits the exposed attack surface to sites using the GitHub-sourced build.

1. Reconnaissance: Identify WordPress sites running the GitHub build of AI Website Builder (gw-website-builder-main) by scanning for the plugin's presence via HTTP fingerprinting or tools like WPScan. Note that the plugin cannot be distinguished from the safe wordpress.org version by version number alone.
2. Enumerate REST API routes: Send unauthenticated HTTP requests to the WordPress REST API (e.g., GET /wp-json/) to discover the plugin's exposed endpoints, which lack any authorization or nonce checks.
3. Write a malicious PHP file: Send a crafted POST request to the file-write REST API endpoint, specifying a PHP webshell as the file content and targeting the uploads directory (e.g., /wp-content/uploads/shell.php).
4. Achieve remote code execution: If the server executes PHP from the uploads directory, access the uploaded webshell via HTTP (e.g., GET /wp-content/uploads/shell.php?cmd=id) to execute arbitrary OS commands.
5. Establish persistence: Leverage the plugin's must-use plugin mechanism — which persists after deactivation — to plant a persistent backdoor script that loads on every page view, or install a malicious plugin via the plugin-install REST API route.
6. Exfiltrate or destroy data: Use the delete-content REST API route to wipe site content and media, or exfiltrate sensitive data (credentials, user data) via the established shell (WPScan, GitHub Advisory).

• Network: Unauthenticated POST requests to WordPress REST API endpoints registered by gw-website-builder-main; outbound HTTP requests from the web server to attacker-controlled URLs (used for content import); unexpected connections from the web server process to external IPs.
• File System: Presence of unexpected PHP files in /wp-content/uploads/ (especially .php files, which should not normally exist there); presence of a must-use plugin file in /wp-content/mu-plugins/ installed by gw-website-builder-main that was not intentionally placed there; unexpected plugins or themes installed without administrator action.
• Logs: Web server access logs showing unauthenticated REST API calls to plugin-specific routes with no authentication headers; PHP error logs referencing unexpected script execution from the uploads directory.
• Database: WordPress options table entries holding attacker-controlled script URLs (injected via the plugin's option-setting functionality); unexpected administrator accounts or plugin activations with no corresponding admin session (WPScan).

There is no fixed version of the GitHub build (gw-website-builder-main) and none is expected; the recommended mitigation is to remove the plugin entirely (WPScan). Removal alone is insufficient: the plugin installs a must-use plugin at activation that is not removed on deactivation, so administrators must also manually delete the must-use plugin file from /wp-content/mu-plugins/ and remove the WordPress option holding the attacker-injectable script URL. As an additional hardening measure, configure the web server to deny PHP execution within the /wp-content/uploads/ directory (e.g., via .htaccess or Nginx configuration). Sites requiring this functionality should migrate to the wordpress.org-distributed version (gw-ai-website-builder), which properly gates these routes behind an administrator capability check (WPScan, GitHub Advisory).

The vulnerability was discovered and reported by Erwan LR of WPScan, who also submitted it for public disclosure (WPScan). Early social media activity was observed on Mastodon shortly after disclosure, and the vulnerability was indexed by multiple threat intelligence aggregators including VulDB, CVEFeed, and Ionix within hours of publication. No major vendor statements or widespread media coverage have been identified beyond the WPScan advisory and GitHub Advisory Database entry.