The Kubio AI Page Builder plugin for WordPress suffers from an authorization bypass due to the plugin’s failure to verify that a user has sufficient privileges before executing the kubio_restore_front_page AJAX action. This flaw, a classic CWE‑862 Authorization Bypass through Privilege Escalation, allows any authenticated user with contributor-level access or higher to overwrite critical front‑page configuration options, rewrite the primary navigation menu, replace template parts, and overwrite the Kubio global‑data post. The plugin’s use of an unconditional nonce that is publicly emitted to any user who can load the block editor removes the intended protection, making it trivial for an attacker to harvest the nonce and perform the unauthorized changes.

WordPress sites that have installed extendthemes: Kubio AI Page Builder version 2.8.5 or earlier are affected. Any installation of this plugin under that version number is vulnerable, regardless of other plugins or themes.

The vulnerability is scored with a CVSS base of 4.3, placing it in the moderate severity range. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, indicating a lower public exploitation risk at present. An attacker must be authenticated and hold at least contributor rights; no further privilege escalation is required. The likely attack vector is via the exposed kubio_restore_front_page AJAX endpoint, which can be invoked from the browser or programmatically by any logged‑in contributor. The absence of advanced obfuscation and the clear exploitation steps in the public code make the vulnerability straightforward to exploit once the required role is granted.