A critical authorization vulnerability in the AI Website Builder plugin allows unauthenticated attackers to achieve remote code execution and full site compromise.

This vulnerability is caused by missing authorization and nonce checks on REST API endpoints (CWE-862). It allows an unauthenticated attacker to manipulate plugin configurations, upload arbitrary files, and execute code if the server environment permits PHP execution within the uploads directory.

The potential impact of this vulnerability is total system compromise. Successful exploitation grants an attacker full control over the WordPress site, including the ability to delete media, inject malicious content, or execute remote code to pivot into the underlying server infrastructure. Given the CVSS score of 9.8, this flaw represents an extreme risk to confidentiality, integrity, and availability.

Immediate Action: Since no specific patch version is currently available, immediately deactivate and remove the AI Website Builder plugin from all WordPress installations.

Proactive Monitoring: Review web server and WordPress access logs for unauthorized POST requests directed at REST API endpoints or unusual file creation events within the wp-content/uploads directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access to the plugin's REST API routes and restrict file execution capabilities within the uploads directory.

Public Exploit Available: Unknown.

The criticality of this vulnerability cannot be overstated, as it provides an unauthenticated path to remote code execution. Administrators must prioritize the immediate removal of the affected plugin to prevent unauthorized access and potential data exfiltration. Until a vendor-supplied update is verified and installed, the software should remain disabled to maintain the security posture of the environment.