WordPress Plugin Vulnerabilities

App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php

Description

The plugin does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data.

Proof of Concept

Affects Plugins

Plugin icon
app-builder
Fixed in 5.7.1

References

CVE
CVE-2026-94294

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
RIA Labs
Submitter
RIA Labs
Submitter website
https://ria-labs.com/
Verified
Yes
WPVDB ID
26ac49f1-657b-49ab-937b-1ceabde1e891

Timeline

Publicly Published
2026-10-16 (about 2 days ago)
Added
2026-10-09 (about 9 days ago)
Last Updated
2026-10-15 (about 3 days ago)

Other

Published
Title
Published
2026-09-03
Title
Agentimus – AI SEO, llms.txt & MCP for AI Agents < 1.51.1 - Missing Authorization
Published
2026-02-18
Title
Pranayama Yoga < 1.2.3 - Missing Authorization
Published
2024-04-01
Title
Sharkdropship for AliExpress Dropshipping and Affiliate < 2.2.5 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
Published
2026-02-13
Title
Starfish Review Generation & Marketing for WordPress < 3.1.20 - Authenticated (Subscriber+) Arbitrary Options Update via srm_restore_options_defaults
Published
2026-02-18
Title
RegistrationMagic < 6.0.7.7 - Missing Authorization