CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
The Kubio AI Page Builder plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the kubio-image-hub-install-plugin AJAX action in all versions up to, and including, 2.6.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install the Image Hub plugin.
Explanation of Vulnerability in Simple Terms
Kubio AI Page Builder versions up to 2.6.3 lack proper authorization checks, allowing authenticated users with low privileges to modify site content and availability. An attacker with a basic user account can alter pages or disable functionality without proper permission validation. Update to a version newer than 2.6.3 to resolve this issue.
What an attacker can do
Modify page content and disable site features using a low-privilege user account.
Potential impact on your site
Unauthorized users can alter published pages and disrupt site availability without admin approval.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
