CVE-2026-2375

🗓️ 21 Mar 2026 03:26:32Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 12 Views🌐 WEB

Unauthenticated users can gain vendor access via role in register endpoint, bypassing vendor approval.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-2375	21 Mar 202603:26	–	attackerkb
CNNVD	WordPress plugin App Builder – Create Native Android & iOS Apps On The Flight 安全漏洞	21 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-2375 App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter	21 Mar 202603:26	–	cvelist
EUVD	EUVD-2026-14012	21 Mar 202606:30	–	euvd
NVD	CVE-2026-2375	21 Mar 202604:16	–	nvd
Patchstack	WordPress App Builder - Create Native Android & iOS Apps On The Flight plugin <= 5.5.10 - Unauthenticated Limited Privilege Escalation via 'role' Parameter vulnerability	23 Mar 202619:05	–	patchstack
Positive Technologies	PT-2026-26834	21 Mar 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-2375	26 Mar 202615:08	–	redhatcve
Vulnrichment	CVE-2026-2375 App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter	21 Mar 202603:26	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (March 16, 2026 to March 22, 2026)	27 Mar 202621:11	–	wordfence

Vulners

Node

appcheap app_builder_create_native_android_&_ios_apps_on_the_flightRange≤5.5.10wordpress

[
  {
    "vendor": "appcheap",
    "product": "App Builder – Create Native Android & iOS Apps On The Flight",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "5.5.10",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/app-builder/tags/5.5.10/includes/Di/Service/Auth/RegisterAuth.php
plugins	www.plugins.trac.wordpress.org/browser/app-builder/tags/5.5.10/includes/Di/Service/Auth/AuthTrails.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/0a4521af-692a-4a84-ba9b-1904a42786c1

Parameter	Position	Path	Description	CWE
role	request body	wp-json/app-builder/v1/register	Unauthenticated users can register with the wcfm_vendor role via the register endpoint, bypassing the vendor approval workflow.	CWE-269

17 Jun 2026 10:30Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.5

EPSS0.0028

SSVC

CWE-269