CVE-2025-8487 is a missing authorization vulnerability (CWE-862) in the Kubio AI Page Builder WordPress plugin by extendthemes. The issue arises from the lack of a capability check on the 'kubio-image-hub-install-plugin' AJAX action, permitting authenticated users with low privileges (Subscriber and above) to install the Image Hub plugin. This could lead to unauthorized plugin installation, potentially impacting the integrity and availability of the WordPress site. The vulnerability affects all versions up to and including 2.6.3. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the user level.

An attacker with authenticated access at Subscriber level or higher can exploit this vulnerability to install a plugin without proper authorization. This unauthorized plugin installation could lead to further compromise of the WordPress environment, including potential denial of service or integrity issues. However, there is no direct confidentiality impact reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and monitor for suspicious plugin installations. Avoid granting Subscriber-level users unnecessary access and consider disabling AJAX actions related to plugin installation if feasible.