CVE-2026-17153 in AI Agent Plugin
Summary
by MITRE • 08/20/2026
The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to upload images to the WordPress media library, bypassing the upload_files capability restriction that Contributors are normally subject to, as authenticated attackers with Contributor-level access or above can satisfy the endpoint's nonce and permission checks. The sg_ai_studio_gutenberg_nonce required by the endpoint is emitted to any user with block editor access — including Contributors — making the absent upload_files check the sole barrier to exploitation.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in the AI Agent plugin for WordPress, specifically within versions up to and including 1.2.7, represents a critical authorization bypass that undermines the fundamental security model of user role management. This flaw stems from an improper verification mechanism where the application fails to enforce strict access controls on specific endpoints responsible for media operations. While the endpoint correctly implements nonce validation and checks for general block editor access, it neglects to verify whether the requesting user possesses the upload_files capability. In WordPress architecture, this capability is a primary gatekeeper that restricts file uploads based on user roles, ensuring that only users with appropriate privileges can modify site assets. The absence of this specific check creates a significant gap in security logic, allowing actions intended for higher-privileged accounts to be executed by lower-privileged or unauthenticated entities under certain conditions.
From an operational perspective, the impact of this vulnerability is substantial as it allows attackers to upload arbitrary files directly into the WordPress media library. For authenticated users with Contributor-level access or above, the attacker can leverage their existing session and nonce to bypass restrictions that should otherwise prevent them from uploading images. More critically, because the sg_ai_studio_gutenberg_nonce required by the endpoint is emitted to any user who has block editor access—including Contributors—the barrier to exploitation is significantly lowered. This means that an unauthenticated attacker could potentially exploit this flaw if they can obtain or predict the nonce, although the primary risk vector involves authenticated low-privilege users escalating their capabilities. The ability to upload images opens the door for further attacks such as web shell deployment, cross-site scripting via malicious image metadata, or resource exhaustion through large file uploads.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures in authorization checks that allow users to perform actions beyond their intended permissions. It also maps closely to MITRE ATT&CK technique T1078, Valid Accounts, as it involves the misuse of legitimate credentials and roles to gain unauthorized access to system functions. The exploitation path demonstrates how a single missing permission check can negate multiple layers of security controls, turning a standard contributor account into a powerful tool for site compromise. Security professionals must recognize that relying solely on nonce validation is insufficient when specific resource-level permissions are not explicitly enforced at the point of action execution.
To mitigate this risk, immediate updates to version 1.2.8 or later are required, as these versions address the authorization logic flaw by ensuring that all file upload operations strictly verify the upload_files capability before proceeding. In environments where updating is not immediately feasible, administrators should consider restricting block editor access for Contributor roles if such functionality is not essential for their workflow. Additionally, implementing web application firewalls with rules targeting suspicious media library API calls can provide a temporary layer of defense against exploitation attempts. Regular auditing of user capabilities and ensuring that plugins adhere to WordPress coding standards regarding capability checks are essential practices to prevent similar authorization bypasses in the future.