CVE-2026-16779: CWE-862 Missing Authorization in extendthemes Kubio AI Page Builder
The Kubio AI Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to overwrite front-page configuration options (show_on_front, page_on_front, and page_for_posts), rewrite primary navigation menu items, replace template parts, and overwrite the Kubio global-data post. Although a nonce check via check_ajax_referer() is present, the nonce is unconditionally emitted into window.kubioUtilsData for every user who can load the block editor, making it harvestable by any Contributor and therefore an ineffective authorization barrier.
AI Analysis
Technical Summary
CVE-2026-16779 describes an authorization bypass vulnerability in the Kubio AI Page Builder plugin for WordPress, affecting all versions up to and including 2.8.5. The plugin fails to properly verify that a user is authorized to perform certain actions, allowing authenticated users with contributor-level permissions or higher to overwrite critical front-page configuration options (such as show_on_front, page_on_front, and page_for_posts), rewrite primary navigation menu items, replace template parts, and overwrite the Kubio global-data post. Although the plugin uses a nonce check via check_ajax_referer(), the nonce is unconditionally exposed in the JavaScript variable window.kubioUtilsData for any user who can load the block editor, including contributors, making the nonce ineffective as an authorization control.
Potential Impact
An attacker with contributor-level access or higher can bypass authorization controls to modify important site configuration and content elements, including front-page settings and navigation menus. This could lead to unauthorized changes to the website's appearance and behavior. There is no indication of confidentiality or availability impact. The CVSS 3.1 base score is 4.3 (medium severity), reflecting limited impact on confidentiality and availability but a clear integrity impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only. Monitor for updates from extendthemes regarding an official fix for this vulnerability.
CVE-2026-16779: CWE-862 Missing Authorization in extendthemes Kubio AI Page Builder
Description
The Kubio AI Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to overwrite front-page configuration options (show_on_front, page_on_front, and page_for_posts), rewrite primary navigation menu items, replace template parts, and overwrite the Kubio global-data post. Although a nonce check via check_ajax_referer() is present, the nonce is unconditionally emitted into window.kubioUtilsData for every user who can load the block editor, making it harvestable by any Contributor and therefore an ineffective authorization barrier.
CVSS v3.1
Score 4.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-16779 describes an authorization bypass vulnerability in the Kubio AI Page Builder plugin for WordPress, affecting all versions up to and including 2.8.5. The plugin fails to properly verify that a user is authorized to perform certain actions, allowing authenticated users with contributor-level permissions or higher to overwrite critical front-page configuration options (such as show_on_front, page_on_front, and page_for_posts), rewrite primary navigation menu items, replace template parts, and overwrite the Kubio global-data post. Although the plugin uses a nonce check via check_ajax_referer(), the nonce is unconditionally exposed in the JavaScript variable window.kubioUtilsData for any user who can load the block editor, including contributors, making the nonce ineffective as an authorization control.
Potential Impact
An attacker with contributor-level access or higher can bypass authorization controls to modify important site configuration and content elements, including front-page settings and navigation menus. This could lead to unauthorized changes to the website's appearance and behavior. There is no indication of confidentiality or availability impact. The CVSS 3.1 base score is 4.3 (medium severity), reflecting limited impact on confidentiality and availability but a clear integrity impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only. Monitor for updates from extendthemes regarding an official fix for this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-07-23T17:19:02.305Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a813f88bf8831d539784bd8
Added to database: 08/16/2026, 04:41:44 UTC
Last enriched: 08/23/2026, 13:24:30 UTC
Last updated: 09/06/2026, 10:52:07 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.