PT-2026-26834 · WordPress+1 · App Builder+1
Gibran Abdillah
·
Publicado
2026-03-21
·
Atualizado
2026-05-08
·
CVE-2026-2375
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress versions prior to 5.5.11
Description
The software contains a flaw that allows unauthorized privilege escalation. The
verify role() function in AuthTrails.php incorrectly allows the wcfm vendor role, alongside subscriber and customer, and assigns it directly via wp insert user() without proper integration with WCFM Marketplace’s vendor approval process. This allows unauthenticated attackers to register an account with the wcfm vendor role by manipulating the role parameter in the /wp-json/app-builder/v1/register API endpoint. Successful exploitation bypasses the standard WCFM vendor approval process, granting immediate vendor-level privileges, including product management, order access, and store management, on sites utilizing WCFM Marketplace.Recommendations
Versions prior to 5.5.11 should be updated.
Correção
LPE
Improper Privilege Management
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
App Builder
Wcfm Marketplace