CVE-2026-16779

Name of the Vulnerable Software and Affected Versions Kubio AI Page Builder versions prior to 2.8.6

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with contributor-level access or higher can exploit this to overwrite front-page configuration options, rewrite primary navigation menu items, replace template parts, and overwrite the Kubio global-data post. This is possible because the nonce used in the check ajax referer() function is unconditionally emitted into window.kubioUtilsData for any user capable of loading the block editor, allowing the nonce to be harvested and bypassing the intended authorization barrier via the kubio restore front page AJAX action.

Recommendations Update to a version newer than 2.8.5.