CVE-2026-83492
Received Received - Intake

Improper Input Validation in Kubio AI Website Builder

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: Tenable Network Security, Inc.

Description
Improper input validation vulnerability in Extend Themes Kubio AI Website Builder. This issue affects Kubio AI Website Builder: before 2.9.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-83492
EUVD
EUVD-2026-68616

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
extend_themes kubio_ai_website_builder to 2.9.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-83492 is an improper input validation flaw in Extend Themes Kubio AI Website Builder affecting versions before 2.9.1. The vulnerability occurs in the REST endpoint GET /wp-json/kubio/v1/enable-theme, which accepts a client-supplied name parameter without proper validation. An attacker with authorized access can exploit this by sending an array instead of a string for the name parameter, causing WordPress to crash due to a TypeError when loading the theme.

Detection Guidance

Check if your Kubio AI Website Builder plugin version is below 2.9.1. Inspect WordPress REST API logs for requests to /wp-json/kubio/v1/enable-theme with array-type name parameters. Look for TypeError entries in server logs indicating theme loading failures.

Impact Analysis

This vulnerability can lead to a Denial of Service (DoS) attack, crashing the entire website. The site remains inaccessible until the issue is manually resolved because the malformed option is reloaded with each request. Users with authorized access can exploit this to disrupt website functionality.

Mitigation Strategies

Upgrade the Kubio AI Website Builder plugin to version 2.9.1 or later immediately. If already exploited, manually reset the stylesheet and template options in the WordPress database to valid string values to restore site functionality.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83492. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart