Unauthenticated REST API Authorization Bypass in WordPress Plugin

The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into the uploads directory, and delete site content and media. On a host that serves PHP from the uploads directory, that file write is remote code execution.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The AI Website Builder WordPress plugin version 1.0.0 contains a critical authorization vulnerability (CWE-862) in its REST API endpoints, allowing unauthenticated attackers to perform privileged administrative actions without any permission checks or nonce validation. This vulnerability affects WordPress sites using the vulnerable plugin and is particularly dangerous because it enables complete site compromise: attackers can install arbitrary plugins, activate malicious themes, import content from attacker-controlled sources, write files to the uploads directory, and delete site content. On servers configured to execute PHP from the uploads directory, this becomes a direct remote code execution vector, giving attackers complete control over the WordPress instance and potentially the underlying server.

Casky's 283 matching security skills use Claude AI's extended reasoning to detect the attack patterns associated with this vulnerability across MITRE ATT&CK Privilege Escalation (TA0004) and Persistence (TA0006) techniques. Practitioners leveraging Casky would identify suspicious patterns including: unauthorized REST API calls to plugin/theme installation endpoints lacking authentication headers, anomalous file writes to /wp-content/uploads/ directories with executable extensions, unexpected plugin activation events without corresponding admin user sessions, and content deletion operations originating from unauthenticated sources. The platform's skill mapping would flag these indicators as matching techniques like Abuse Elevation Control Mechanism and Create or Modify System Process, enabling security teams to correlate attack telemetry and distinguish legitimate WordPress operations from exploitation attempts targeting this specific authorization bypass.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-82923.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-82923

Casky has 283 skills that investigate the attack patterns behind CVE-2026-82923. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn