Authorization Bypass Vulnerability in AI Agent Plugin for WordPress by SiteGround

CVE-2026-17153

What is CVE-2026-17153?

The AI Agent for WordPress by SiteGround has a vulnerability allowing unauthorized users to upload images to the media library. This occurs due to inadequate verification processes in the plugin that fail to ensure user authorization for specific actions. As a result, attackers without authentication can exploit this loophole, effectively bypassing the capability restrictions typically enforced for Contributors. The vulnerability is primarily linked to the improper handling of nonce and permission checks associated with the image upload functionality, which exposes serious risks for WordPress sites utilizing this plugin.

References