Executive brief
Kubio AI Website Builder is a WordPress plugin that enables users to build websites visually without coding. An authenticated attacker can send a malformed request to a REST API endpoint that causes the plugin to corrupt WordPress settings, resulting in a complete site outage that persists until manually repaired. This could prevent access to critical business websites and customer-facing applications until administrators intervene.
Technical details
The vulnerability is an improper input validation flaw in the `/wp-json/kubio/v1/enable-theme` REST endpoint. The endpoint accepts a `name` parameter and passes it directly to WordPress's `switch_theme()` function without type checking. An authenticated attacker can supply `name` as an array instead of a string, causing the serialized array to be stored in WordPress core options (`stylesheet`/`template`). On subsequent page loads, WordPress's `get_stylesheet()` function—typed to return a string—throws a TypeError during theme initialization, causing a fatal error and persistent site outage. The flaw requires authentication (high-privilege REST access) but can be exploited remotely with no user interaction. The issue is fixed in version 2.9.1.
Affected products
- Extend Themes Kubio AI Website Builder before 2.9.1
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Fixed in version 2.9.1