The Kubio AI Page Builder plugin for WordPress contains an authorization flaw in the kubio_rest_pre_insert_import_assets() function, which is triggered on the REST API’s post insertion hooks. When a post or page is created via the REST API, the plugin scans the supplied block attributes for URLs in the 'kubio' namespace and automatically downloads and imports those resources without checking the user’s upload_files capability. An authenticated user with Contributor level or higher can therefore upload arbitrary files from external URLs to the media library, resulting in unintended attachment posts and possible execution of malicious content.

The affected product is the Kubio AI Page Builder plugin (developed by extendthemes) for WordPress. Versions 2.7.2 and older are vulnerable; the issue persists in all releases up to and including 2.7.2. No other vendors or product lines are listed as impacted in the CVE. WordPress installations that load this plugin and expose the REST API for post-type content are at risk.

The vulnerability carries a CVSS base score of 5.3, placing it in the Medium severity range. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalogue, suggesting no confirmed large‑scale exploitation yet. Nevertheless, an attacker who manages to authenticate as a Contributor or higher and grants themselves the ability to hit the REST API can immediately bypass normal media‑upload controls. The lack of an authorization check allows foreign files to be stored and potentially executed, which could lead to arbitrary code execution or defacement if the uploaded asset is malicious. The attack path requires only an existing authenticated session and the ability to submit a REST request, making it relatively straightforward for users with approved roles.