WordPress AI Website Builder Plugin Unauthenticated Access

The AI Website Builder WordPress plugin (GitHub build) 1.0.0 is affected.

It lacks authorisation and nonce checks on its REST API routes, allowing unauthenticated attackers to:

• Install and activate plugins and themes
• Import content from a malicious URL
• Write a file to the uploads directory
• Delete site content and media

On hosts serving PHP from the uploads directory, the file write can lead to remote code execution.