Authorization Bypass Vulnerability in Kubio AI Page Builder Plugin for WordPress

CVE-2026-16779

What is CVE-2026-16779?

The Kubio AI Page Builder plugin for WordPress has a vulnerability allowing authenticated attackers with contributor-level access to bypass authorization. This flaw results from inadequate verification mechanisms, enabling them to manipulate front-page configuration options, alter primary navigation menu items, and overwrite essential data. Despite the presence of a nonce check, it is improperly exposed and collectible by any user able to access the block editor, rendering it ineffective as a security measure. Users should update to the latest version to mitigate this risk.

References