CVE-2026-17153

Name of the Vulnerable Software and Affected Versions AI Agent by SiteGround versions prior to 1.2.8

Description The plugin fails to properly verify user authorization, leading to an authorization bypass. This allows authenticated attackers with Contributor-level access or higher to upload images to the WordPress media library, bypassing the upload files capability restriction. The issue exists because the /generate-content REST endpoint requires a sg ai studio gutenberg nonce that is provided to any user with block editor access, but it does not verify the necessary upload permissions.

Recommendations Update the plugin to a version newer than 1.2.7. Restrict access to the /generate-content REST endpoint to minimize the risk of exploitation.