PT-2026-26865 · Hakeemnala · Build App Online

Ronnachai Chaipha

·

Published

2026-03-21

·

Updated

2026-03-21

·

CVE-2026-3651

CVSS v3.1

5.3

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
The Build App Online plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.23. This is due to the plugin registering the 'build-app-online-update-vendor-product' AJAX action via wp ajax nopriv without proper authentication checks, capability verification, or nonce validation in the update vendor product() function. The function accepts a user-supplied post ID from the request and calls wp update post() to modify the post author field without validating whether the user has permission to modify the specified post. This makes it possible for unauthenticated attackers to modify the post author of arbitrary posts to 0 (orphaning posts from their legitimate authors), or for authenticated attackers to claim ownership of any post by setting themselves as the author.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-3651

Affected Products

Build App Online