Vulnerability Uncovered In Wix Vibe Coding Platform via @sejournal, @martinibuster

Cloud security company Wiz discovered a critical flaw in Wix’s Base44 vibe coding platform that enabled attackers to bypass authentication and gain access to private enterprise applications. The relative simplicity of finding what should have been a secret app ID number, and using it to gain access, made the vulnerability a serious concern.

Exposed Sensitive Identification Number

An apparently randomly generated identification number, called an app_id, was embedded in public-facing paths such as the application URL and the manifest.json file. Attackers could use that data to generate a verified account, even when user registration was disabled. This bypassed the platform’s access controls, including Single Sign-On (SSO), which many organizations use for enterprise security.

The Wiz security report notes how easy it was to find the sensitive app_id numbers:

“When we navigate to any application developed on top of Base44, the app_id is immediately visible in the URI and manifest.json file path, all applications have their app_ids value hardcoded in their manifest path: manifests/{app_id}/manifest.json.”

Creating A Rogue Account Was Relatively Trivial

The vulnerability did not require privileged access or deep technical expertise. Once an attacker identified a valid app_id, they could use tools like the open source Swagger-UI to register a new account, receive a one-time password (OTP) via email, and verify the account without restriction.

From there, logging in through the application’s SSO flow granted full access to internal systems, despite the original access being restricted to specific users or teams. This process exposed a serious flaw in the platform’s assumption that the app_id would not be tampered with or reused externally.

Authentication Flaw Risked Exposure of Sensitive Data

Many of the affected apps were built using the popular Base44 vibe coding platform for internal use, supporting operations such as HR, chatbots, and knowledge bases. These systems contained personally identifiable information (PII) and were used for HR operations. The exploit enabled attackers to bypass identity controls and access private enterprise applications, potentially exposing sensitive data.

Wix Fixes Flaw Within 24 Hours

The cloud security company discovered the flaw by using a methodical process of examining public information for potential weak points, eventually culminating in finding the exposed app_id numbers, and from there creating the workflow for generating access to accounts. They next contacted Wix, which immediately fixed the issue.

According to the report published by the security company, there is no evidence that the flaw was exploited, and the vulnerability has been fully addressed.

Threat To Entire Ecosystems

The Wiz security report noted that the practice of vibe coding is proceeding at a rapid pace and with not enough time to address potential security issues, expressing the opinion that it creates “systemic risks” not just to individual apps but to “entire ecosystems.”

Why Did This Security Incident Happen?

Wix States It Is Proactive On Security

The report published a statement from Wix that states that they are proactive about security:

“We continue to invest heavily in strengthening the security of all products and potential vulnerabilities are proactively managed. We remain committed to protecting our users and their data.”

Security Company Says Discovery Of Flaw Was Simple

The report by Wiz describes the discovery as a relatively simple matter, explaining that they used “straightforward reconnaissance techniques,” including “passive and active discovery of subdomains,” which are widely accessible methods.

The security report explained that exploiting the flaw was simple:

“What made this vulnerability particularly concerning was its simplicity – requiring only basic API knowledge to exploit. This low barrier to entry meant that attackers could systematically compromise multiple applications across the platform with minimal technical sophistication.”

The existence of that report, in itself, raises the concern that if discovering the issue was “straightforward” and exploiting it had a “low barrier to entry,” how is it that Wix was proactive and yet this was not discovered?

• If they had used a third-party security testing company, why hadn’t they discovered the publicly available app_id numbers?
• The manifest.json exposure is trivial to detect. Why hadn’t that been flagged by a security audit?

The contradiction between a simple discovery/exploit process and Wix’s claimed proactive security posture raises a reasonable doubt about the thoroughness or effectiveness of their proactive measures.

Takeaways:

• Simple Discovery and Exploitation:
  The vulnerability could be found and exploited using basic tools and publicly available information, with no need for advanced skills or insider access.
• Bypassing Enterprise Controls:
  Attackers could gain full access to internal apps despite controls like disabled registration and SSO-based identity restrictions.
• Systemic Risk from Vibe Coding:
  Wiz warns that fast-paced vibe coding platforms may introduce widespread security risks across application ecosystems.
• Discrepancy Between Claims and Reality:
  The ease of exploitation contrasts with Wix’s claims of proactive security, prompting questions about the thoroughness of their security audits.

Wiz discovered that Wix’s Base44 vibe coding platform exposed a critical vulnerability that could have enabled attackers to bypass authentication and access internal enterprise applications.  The security company that discovered the flaw expressed the opinion that this incident highlights potential risks of insufficient security considerations, which can put entire ecosystems at risk.

Read the original report:

Wiz Research Uncovers Critical Vulnerability in AI Vibe Coding platform Base44 Allowing Unauthorized Access to Private Applications

Featured Image by Shutterstock/mailcaroline

Wix Announces AI Visibility Overview Citation & Sentiment Tracking Tool via @sejournal, @martinibuster

Wix adds support for Generative Engine Optimization (GEO) with new AI visibility tool called The AI Visibility Overview, available to users with a Wix Business Manager account in English, with more languages rolling out soon. AI Visibility Overview enables users to track citations, track AI query volume and traffic plus benchmark performance against competitors.

AI Visibility Overview

Wix continues its innovative and forward-thinking approach to adding AI-powered tools that provide users with real-world benefits that help get work done. Tracking AI visibility is an advanced capability that no other CMS offers.

The newly announced AI tools provides the following benefits for Generative Engine Optimization (GEO):

• “Manage AI citations & visibility:
  Users can track how often their website is cited by AI platforms in response to relevant queries, as well as add, or remove questions to better reflect their business.
• Monitor brand sentiment across LLMs:
  GEO empowers users to stay informed on how their brand is perceived by analyzing sentiment, perception, and positioning in AI-generated content.
• Benchmark visibility and competitive context:
  Users can compare their AI visibility performance to competitors to gain a better understanding of how their visibility stacks up against industry peers, identify growth opportunities, and discover which other sources are being cited in similar contexts.
• Measure AI-driven traffic & query volume:
  Users can see how much traffic is driven to their site from AI platforms, as well as how frequently people ask about their brand or services in these engines.”

AI Visibility

Business customers are increasingly searching with AI, and Wix’s new AI Visibility Overview is the right tool at the right time for businesses, enabling them to keep up with where customers are today and offering a competitive advantage over the competition.

Read more about the new tool here:

Wix Analytics: About the AI Visibility Overview

Featured Image by Shutterstock/Roman Samborskyi

Wix Announces Adaptive Content For Driving Higher Sales & Engagement via @sejournal, @martinibuster

Wix announced a new feature that enables businesses to create personalized content for visitors, increasing relevance and opportunities for higher sales and lead generation. The feature integrates AI into the workflow, making it easier for publishers to deliver advanced personalized experiences to returning customers.

Relevance = Higher Sales

It’s commonly known that site visitors who visit a site that’s an exact match for the keywords used in a search tend to convert at a higher rate than visitors that to a site that has less relevant  content. A website experience that’s directly relevant to site visitors contributes to higher conversion rates. Being able to optimize factors that contribute to relevance to site visitors is an innovative and useful way to deploy technology.

The new feature is easily configurable and offers simulations of what the adaptive content may look like so that Wix users can preview what their site visitors will see.

Muly Gelman, Senior Product Manager at Wix Personalize shared:

“Website personalization is now essential for delivering the relevant, engaging experiences today’s consumers expect. This application highlights how we can move beyond using AI to generate website content but leverage AI to dynamically adapt and personalize the live website experience for each visitor in real-time, empowering businesses to connect more effectively with their customers.

As a result, businesses can deliver engaging, personalized experiences that resonate with their audience, ultimately driving higher engagement rates and creating greater monetization opportunities.”

The new adaptive content feature complements their new Automation Builder and the Wix Functions feature.

Featured Image by Shutterstock/chainarong06

Wix Integrates Session Recording Toolkit Into Analytics Interface via @sejournal, @martinibuster

Wix has integrated TWIPLA’s session recording toolkit into its analytics reports, enabling users to replay visitor interactions and make data-driven decisions to improve user experience and conversions

Session Recordings Toolkit

TWIPLA, a German website analytics company, announced the native integration of their session recording toolkit directly within the Wix analytics reports. Wix publishers can now replay video that replays actual customer journeys through the site, to better understand customer behavior. This analytics feature is integrated directly within the Wix analytics interface.

Noa Kroytoro, Product Manager at Wix Analytics, commented:

“The launch of the session recordings toolkit enhances the reporting tools available to Wix users through Wix Analytics, providing them with deeper insights into customer behavior for
more effective user experience optimization. Our partnership with TWIPLA enables us to deliver our users a powerful solution for data-driven decision making.”

TWIPLA CEO Tim Hammermann, said:

“It’s one of the most popular tools we have and our clients have found that it helps them to make tangible improvements to online success, particularly because the granular filtering
system makes it so easy to find session replays that match specific visitor segments.”

Full instructions and details of how to use the new session recordings are available on the Wix website:

Wix Analytics: Adding and Setting Up Session Recordings

Read the official announcement by Twipla:

TWIPLA expands partnership with Wix, powering new session recordings toolkit for advanced UX optimization (PDF)