PT-2026-26865 · WordPress · Build App Online

Ronnachai Chaipha

·

Published

2026-03-21

·

Updated

2026-03-21

·

CVE-2026-3651

CVSS v3.1

5.3

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions Build App Online plugin for WordPress versions prior to 1.0.24
Description The Build App Online plugin for WordPress is susceptible to unauthorized access. The plugin registers the build-app-online-update-vendor-product API endpoint via wp ajax nopriv without sufficient security measures. Specifically, there are no authentication checks, capability verification, or nonce validation within the update vendor product() function. This function accepts a user-supplied post ID and uses wp update post() to modify the post author field without verifying user permissions. This allows unauthenticated attackers to modify the post author of any post to 0, effectively removing the original author. Authenticated attackers can also claim ownership of posts by changing the post author to their own user ID. The vulnerable parameter is post ID.
Recommendations Update the Build App Online plugin to version 1.0.24 or later.

Fix

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2026-3651

Affected Products

Build App Online