PT-2025-38508 · WordPress+1 · Kubio Ai Page Builder+1

Wesley · Published 2025-09-19 · Updated 2025-09-19 · CVE-2025-8487

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Kubio AI Page Builder plugin for WordPress versions up to and including 2.6.3

Description The Kubio AI Page Builder plugin for WordPress is susceptible to unauthorized plugin installation due to a missing capability check on the kubio-image-hub-install-plugin AJAX action. This allows authenticated attackers with Subscriber-level access or higher to install the Image Hub plugin.

Recommendations Update Kubio AI Page Builder plugin to a version later than 2.6.3.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-8487

Affected Products

Image Hub

Kubio Ai Page Builder

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-8487 · Security Note
• https://twitter.com/CVEnew/status/1968923560799322188 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/1f528c89-2b8c-4750-b9eb-47ebd8c1630e?source=cve · Note
• https://t.me/cveNotify/135905 · Telegram Post
• https://plugins.trac.wordpress.org/browser/kubio/tags/2.6.3/lib/integrations/image-hub/image-hub.php#L70 · Note
• https://t.me/CVEtracker/32913 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3361499/kubio/trunk/lib/integrations/image-hub/image-hub.php · Note
• https://twitter.com/VulmonFeeds/status/1968971822650503462 · Twitter Post