PT-2026-26834 · WordPress+1 · App Builder+1

Gibran Abdillah

·

Published

2026-03-21

·

Updated

2026-05-08

·

CVE-2026-2375

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress versions prior to 5.5.11
Description The software contains a flaw that allows unauthorized privilege escalation. The verify role() function in AuthTrails.php incorrectly allows the wcfm vendor role, alongside subscriber and customer, and assigns it directly via wp insert user() without proper integration with WCFM Marketplace’s vendor approval process. This allows unauthenticated attackers to register an account with the wcfm vendor role by manipulating the role parameter in the /wp-json/app-builder/v1/register API endpoint. Successful exploitation bypasses the standard WCFM vendor approval process, granting immediate vendor-level privileges, including product management, order access, and store management, on sites utilizing WCFM Marketplace.
Recommendations Versions prior to 5.5.11 should be updated.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-2375

Affected Products

App Builder
Wcfm Marketplace