CVE-2026-17153: SiteGround AI Agent Auth Bypass Flaw

CVE-2026-17153 Overview

CVE-2026-17153 is an authorization bypass vulnerability in the AI Agent by SiteGround plugin for WordPress, affecting all versions up to and including 1.2.7. The plugin fails to verify that a user holds the upload_files capability before accepting image uploads to the WordPress media library. Contributor-level users, who normally cannot upload media, can satisfy the endpoint's nonce and permission checks because the sg_ai_studio_gutenberg_nonce is emitted to any user with block editor access. The flaw is categorized as Missing Authorization [CWE-862].

Critical Impact
Authenticated Contributors, and in some conditions unauthenticated attackers, can upload arbitrary images to the WordPress media library, bypassing the plugin's intended capability restrictions.

Affected Products

AI Agent by SiteGround plugin for WordPress
Versions up to and including 1.2.7
WordPress sites running the sg-ai-studio plugin with block editor access enabled

Discovery Timeline

2026-08-20 - CVE-2026-17153 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-17153

Vulnerability Analysis

The AI Agent by SiteGround plugin exposes a REST API endpoint that accepts image uploads to the WordPress media library. The endpoint enforces two checks: nonce verification via sg_ai_studio_gutenberg_nonce and a permission callback. Neither check validates the user's upload_files capability, which WordPress uses to restrict media uploads for Contributors and lower-privileged roles. Because the nonce is emitted to any user with block editor access, Contributor accounts can obtain a valid nonce and satisfy the endpoint's checks. The absent capability check is the sole barrier separating a Contributor from the media upload workflow that WordPress otherwise reserves for Authors and above.

Root Cause

The root cause is a missing authorization check [CWE-862] in the plugin's REST route handlers located in core/Rest/Gutenberg.php and core/Rest/Rest.php. The permission callback confirms that the caller has block editor access and a valid nonce, but it never calls current_user_can('upload_files') before writing the uploaded media. The Helper class in core/Helper/Helper.php completes the upload without re-validating capabilities.

Attack Vector

An attacker with Contributor-level access authenticates to WordPress, opens the block editor to obtain the sg_ai_studio_gutenberg_nonce, and issues a REST request to the vulnerable upload endpoint with an image payload. The plugin accepts the request and writes the file into the WordPress uploads directory, adding an attachment record to the media library. Because the vector is network-based and requires only low-privileged authentication, exploitation does not require user interaction from an administrator.

See the WordPress plugin source in Gutenberg.php and Rest.php for the affected route registrations.

Detection Methods for CVE-2026-17153

Indicators of Compromise

Unexpected attachment records in the WordPress media library created by Contributor-role users.
REST API requests to the sg-ai-studio plugin's Gutenberg upload endpoints from accounts that lack the upload_files capability.
New files in the wp-content/uploads/ directory whose author metadata references a Contributor account.

Detection Strategies

Audit the wp_posts table for attachment post types authored by users assigned the Contributor role.
Review web server access logs for POST requests to REST routes registered by the sg-ai-studio plugin, cross-referencing against the authenticated user's WordPress role.
Enable WordPress debug logging or a security plugin that records REST API activity, then filter for the sg_ai_studio_gutenberg_nonce in request bodies.

Monitoring Recommendations

Alert on any media upload where the acting user does not possess the upload_files capability.
Monitor for spikes in attachment creation events tied to low-privilege accounts.
Track outbound links and referenced media in newly created draft posts submitted by Contributors for potentially malicious content.

How to Mitigate CVE-2026-17153

Immediate Actions Required

Update the AI Agent by SiteGround plugin to a version later than 1.2.7 once the vendor publishes a fixed release.
Audit Contributor and higher-role accounts for signs of unauthorized media uploads since the plugin was installed.
Restrict Contributor-role registration and review any recently created low-privilege accounts.

Patch Information

The vulnerability affects all versions up to and including 1.2.7. Review the plugin changeset on plugins.trac.wordpress.org and the Wordfence advisory for the corrected code and the recommended upgrade target.

Workarounds

Deactivate the sg-ai-studio plugin until a patched version is installed.
Use a Web Application Firewall (WAF) rule to block REST requests to the plugin's Gutenberg upload endpoints from sessions whose associated user lacks upload_files.
Remove block editor access from Contributor accounts if the workflow does not require it, which prevents distribution of the sg_ai_studio_gutenberg_nonce.

bash

# Disable the vulnerable plugin from WP-CLI until a patch is available
wp plugin deactivate sg-ai-studio

# List Contributor accounts to review for suspicious media uploads
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered