CVE-2024-9302

🗓️ 25 Oct 2024 06:51:23Reported by WordfenceType

The App Builder plugin for WordPress allows privilege escalation via account takeover due to insufficient controls in OTP and password reset function

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2024-9302	25 Oct 202410:23	–	circl
CNNVD	WordPress plugin App Builder 授权问题漏洞	25 Oct 202400:00	–	cnnvd
Cvelist	CVE-2024-9302 App Builder – Create Native Android & iOS Apps On The Flight <= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTP	25 Oct 202406:51	–	cvelist
EUVD	EUVD-2024-49847	3 Oct 202520:07	–	euvd
NVD	CVE-2024-9302	25 Oct 202407:15	–	nvd
Patchstack	WordPress App Builder – Create Native Android & iOS Apps On The Flight plugin <= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTP vulnerability	24 Oct 202421:52	–	patchstack
Patchstack	WordPress App Builder Plugin <= 5.3.7 is vulnerable to Broken Authentication	24 Oct 202400:00	–	patchstack
Positive Technologies	PT-2024-39557 · WordPress · The App Builder – Create Native Android & Ios Apps On The Flight	25 Oct 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-9302	5 Feb 202504:28	–	redhatcve
Vulnrichment	CVE-2024-9302 App Builder – Create Native Android & iOS Apps On The Flight <= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTP	25 Oct 202406:51	–	vulnrichment

NVD

Vulners

Vulnrichment

Node

appcheap app_builderRange≤5.3.7wordpress

[
  {
    "vendor": "appcheap",
    "product": "App Builder – Create Native Android & iOS Apps On The Flight",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "5.3.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3161215/
plugins	www.plugins.trac.wordpress.org/browser/app-builder/tags/5.3.1/includes/Di/Service/Auth/ForgotPassword.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/0eb9d676-4fa0-4bdc-af44-5d7e1dd8c6e6
plugins	www.plugins.trac.wordpress.org/browser/app-builder/tags/5.3.1/includes/Di/Service/Auth/ForgotPassword.php

08 Apr 2026 16:35Current

8.8High risk

Vulners AI Score8.8

CVSS 3.18.1 - 9.8

EPSS0.00715

SSVC

CWE-640