https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 21:27:27 +0000 https://cve.radiocsirt.org/vuln/cve-2026-5427 <p><strong>Affected:</strong> extendthemes Kubio AI Page Builder</p> <p>The Kubio plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 2.7.2. This is due to insufficient capability checks in the kubio_rest_pre_insert_import_assets() function, which is hooked to the rest_pre_insert_{post_type} filter for posts, pages, templates, and template parts. When a post is created or updated via the REST API, Kubio parses block attributes looking for URLs in the &#39;kubio&#39; attribute namespace and automatically imports them via importRemoteFile() without verifying the user has the upload_files capability. This makes it possible for authenticated attackers with Contributor-level access and above to bypass WordPress&#39;s normal media upload restrictions and upload files fetched from external URLs to the media library, creating attachment posts in the database.</p> <p><strong>Affected:</strong> extendthemes Kubio AI Page Builder</p> <p>The Kubio plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 2.7.2. This is due to insufficient capability checks in the kubio_rest_pre_insert_import_assets() function, which is hooked to the rest_pre_insert_{post_type} filter for posts, pages, templates, and template parts. When a post is created or updated via the REST API, Kubio parses block attributes looking for URLs in the &#39;kubio&#39; attribute namespace and automatically imports them via importRemoteFile() without verifying the user has the upload_files capability. This makes it possible for authenticated attackers with Contributor-level access and above to bypass WordPress&#39;s normal media upload restrictions and upload files fetched from external URLs to the media library, creating attachment posts in the database.</p> https://cve.radiocsirt.org/vuln/cve-2026-5427