The vulnerability resides in the Kubio AI Page Builder plugin for WordPress. A missing capability check on the kubio-image-hub-install-plugin AJAX action permits any authenticated user with Subscriber‑level access or higher to trigger the installation of the Image Hub plugin. This flaw allows an attacker to install an additional plugin without proper authorization, potentially enabling malicious code execution or further privilege escalation on the WordPress site.

WordPress sites that have the Kubio AI Page Builder plugin version 2.6.3 or earlier installed are affected. The plugin is distributed by extendthemes, and all users with Subscriber or higher roles are at risk.

The CVSS score of 5.4 indicates moderate severity, while the EPSS of less than 1% reflects a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Authenticated users with Subscriber‑level access can exploit the flaw by sending a request to the AJAX endpoint, installing the Image Hub plugin, and thereby gaining the capabilities of that plugin. Because the attack requires only a legitimate authenticated session, it could be executed by compromised accounts or via social engineering. Prompt remediation is advised to prevent unauthorized plugin installation.