PT-2026-36563 · WordPress · App Builder
Ren Voza
·
Published
2026-05-02
·
Updated
2026-05-02
·
CVE-2026-7638
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
App Builder – Create Native Android & iOS Apps On The Flight versions prior to 5.6.1
Description
An Insecure Direct Object Reference (IDOR) exists due to missing authorization validation in the
upload avatar() function. The /wp-json/app-builder/v1/upload-avatar endpoint accepts an attacker-controlled user id parameter from the POST request body and updates user meta without verifying if the authenticated requester has permission to modify the target account. This allows authenticated attackers with Subscriber-level access or higher to overwrite the profile avatar of any user, including administrators.Recommendations
Update to a version later than 5.6.0.
As a temporary workaround, restrict access to the
/wp-json/app-builder/v1/upload-avatar endpoint or disable the upload avatar() function until the update is applied.Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
App Builder