CVE-2026-5427

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5427", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-04-02T14:24:35.903Z", "datePublished": "2026-04-17T03:36:44.993Z", "dateUpdated": "2026-04-17T18:48:57.774Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-17T03:36:44.993Z"}, "affected": [{"vendor": "extendthemes", "product": "Kubio AI Page Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.7.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Kubio plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 2.7.2. This is due to insufficient capability checks in the kubio_rest_pre_insert_import_assets() function, which is hooked to the rest_pre_insert_{post_type} filter for posts, pages, templates, and template parts. When a post is created or updated via the REST API, Kubio parses block attributes looking for URLs in the 'kubio' attribute namespace and automatically imports them via importRemoteFile() without verifying the user has the upload_files capability. This makes it possible for authenticated attackers with Contributor-level access and above to bypass WordPress's normal media upload restrictions and upload files fetched from external URLs to the media library, creating attachment posts in the database."}], "title": "Kubio AI Page Builder <= 2.7.2 - Missing Authorization to Authenticated (Contributor+) Limited File Upload via Kubio Block Attributes", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d8096f3c-e1a9-424f-af10-3e80212db985?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/kubio/trunk/lib/src/Core/Importer.php#L546"}, {"url": "https://plugins.trac.wordpress.org/browser/kubio/tags/2.7.1/lib/src/Core/Importer.php#L546"}, {"url": "https://plugins.trac.wordpress.org/browser/kubio/trunk/lib/importer/importer-filters/kubio-blocks.php#L20"}, {"url": "https://plugins.trac.wordpress.org/browser/kubio/tags/2.7.1/lib/importer/importer-filters/kubio-blocks.php#L20"}, {"url": "https://plugins.trac.wordpress.org/browser/kubio/trunk/lib/filters/post-insert.php#L17"}, {"url": "https://plugins.trac.wordpress.org/browser/kubio/tags/2.7.1/lib/filters/post-insert.php#L17"}, {"url": "https://plugins.trac.wordpress.org/changeset/3506647/kubio/trunk/lib/src/Core/Importer.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "SeungRyeol Baek"}], "timeline": [{"time": "2026-04-02T14:40:37.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-16T15:06:55.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-17T18:48:48.792992Z", "id": "CVE-2026-5427", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-17T18:48:57.774Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5427", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-17T18:48:48.792992Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-17T18:48:53.490Z"}}], "cna": {"title": "Kubio AI Page Builder <= 2.7.2 - Missing Authorization to Authenticated (Contributor+) Limited File Upload via Kubio Block Attributes", "credits": [{"lang": "en", "type": "finder", "value": "SeungRyeol Baek"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "extendthemes", "product": "Kubio AI Page Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.7.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-04-02T14:40:37.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-04-16T15:06:55.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d8096f3c-e1a9-424f-af10-3e80212db985?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/kubio/trunk/lib/src/Core/Importer.php#L546"}, {"url": "https://plugins.trac.wordpress.org/browser/kubio/tags/2.7.1/lib/src/Core/Importer.php#L546"}, {"url": "https://plugins.trac.wordpress.org/browser/kubio/trunk/lib/importer/importer-filters/kubio-blocks.php#L20"}, {"url": "https://plugins.trac.wordpress.org/browser/kubio/tags/2.7.1/lib/importer/importer-filters/kubio-blocks.php#L20"}, {"url": "https://plugins.trac.wordpress.org/browser/kubio/trunk/lib/filters/post-insert.php#L17"}, {"url": "https://plugins.trac.wordpress.org/browser/kubio/tags/2.7.1/lib/filters/post-insert.php#L17"}, {"url": "https://plugins.trac.wordpress.org/changeset/3506647/kubio/trunk/lib/src/Core/Importer.php"}], "descriptions": [{"lang": "en", "value": "The Kubio plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 2.7.2. This is due to insufficient capability checks in the kubio_rest_pre_insert_import_assets() function, which is hooked to the rest_pre_insert_{post_type} filter for posts, pages, templates, and template parts. When a post is created or updated via the REST API, Kubio parses block attributes looking for URLs in the 'kubio' attribute namespace and automatically imports them via importRemoteFile() without verifying the user has the upload_files capability. This makes it possible for authenticated attackers with Contributor-level access and above to bypass WordPress's normal media upload restrictions and upload files fetched from external URLs to the media library, creating attachment posts in the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-17T03:36:44.993Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5427", "state": "PUBLISHED", "dateUpdated": "2026-04-17T18:48:57.774Z", "dateReserved": "2026-04-02T14:24:35.903Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-17T03:36:44.993Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Kubio AI Page Builder", "vendor": "extendthemes", "versions": [{"lessThanOrEqual": "2.7.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Kubio plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 2.7.2. This is due to insufficient capability checks in the kubio_rest_pre_insert_import_assets() function, which is hooked to the rest_pre_insert_{post_type} filter for posts, pages, templates, and template parts. When a post is created or updated via the REST API, Kubio parses block attributes looking for URLs in the 'kubio' attribute namespace and automatically imports them via importRemoteFile() without verifying the user has the upload_files capability. This makes it possible for authenticated attackers with Contributor-level access and above to bypass WordPress's normal media upload restrictions and upload files fetched from external URLs to the media library, creating attachment posts in the database."}], "id": "CVE-2026-5427", "lastModified": "2026-06-17T10:59:00.787", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5427", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-17T18:48:48.792992Z", "version": "2.0.3"}}]}, "published": "2026-04-17T05:16:18.973", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/kubio/tags/2.7.1/lib/filters/post-insert.php#L17"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/kubio/tags/2.7.1/lib/importer/importer-filters/kubio-blocks.php#L20"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/kubio/tags/2.7.1/lib/src/Core/Importer.php#L546"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/kubio/trunk/lib/filters/post-insert.php#L17"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/kubio/trunk/lib/importer/importer-filters/kubio-blocks.php#L20"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/kubio/trunk/lib/src/Core/Importer.php#L546"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3506647/kubio/trunk/lib/src/Core/Importer.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d8096f3c-e1a9-424f-af10-3e80212db985?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.7.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Kubio AI Page Builder", "source": "cna", "vendor": "extendthemes"}, "product": "kubio_ai_page_builder", "vendor": "extendthemes"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-17T05:51:18.874544+00:00", "value": {"mitigation_remediation": ["Apply the latest Kubio AI Page Builder update (version 2.7.3 or later, if available) to remove the improper capability check.", "Should an update not be possible, limit Contributor and lower role access to the REST API endpoints used for post creation or modification, or revoke the 'upload_files' capability for those roles to prevent remote file imports.", "Review the media library for unexpected attachments and remove any that appear to have been uploaded via unauthorized remote sourcing. As an extra precaution, enforce strict MIME type validation and disable external URL fetching if the platform supports it."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary File Upload"}, "threat_synthesis": {"affected_systems": "The affected product is the Kubio AI Page Builder plugin (developed by extendthemes) for WordPress. Versions 2.7.2 and older are vulnerable; the issue persists in all releases up to and including 2.7.2. No other vendors or product lines are listed as impacted in the CVE. WordPress installations that load this plugin and expose the REST API for post-type content are at risk.", "description_and_impact": "The Kubio AI Page Builder plugin for WordPress contains an authorization flaw in the kubio_rest_pre_insert_import_assets() function, which is triggered on the REST API\u2019s post insertion hooks. When a post or page is created via the REST API, the plugin scans the supplied block attributes for URLs in the 'kubio' namespace and automatically downloads and imports those resources without checking the user\u2019s upload_files capability. An authenticated user with Contributor level or higher can therefore upload arbitrary files from external URLs to the media library, resulting in unintended attachment posts and possible execution of malicious content.", "risk_and_exploitability": "The vulnerability carries a CVSS base score of 5.3, placing it in the Medium severity range. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalogue, suggesting no confirmed large\u2011scale exploitation yet. Nevertheless, an attacker who manages to authenticate as a Contributor or higher and grants themselves the ability to hit the REST API can immediately bypass normal media\u2011upload controls. The lack of an authorization check allows foreign files to be stored and potentially executed, which could lead to arbitrary code execution or defacement if the uploaded asset is malicious. The attack path requires only an existing authenticated session and the ability to submit a REST request, making it relatively straightforward for users with approved roles."}}}}, "created": "2026-04-17T05:30:10.323951+00:00", "updated": "2026-04-17T06:00:09.260591+00:00", "vendors": ["extendthemes", "extendthemes$PRODUCT$kubio_ai_page_builder", "wordpress", "wordpress$PRODUCT$wordpress"]}