CVE-2026-2375

🗓️ 21 Mar 2026 03:26:32Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 32 Views🌐 WEB

Unauthenticated users can gain vendor access via role in register endpoint, bypassing vendor approval.

Reporter	Title	Published	Views	Family All 11
attackerkb	CVE-2026-2375	21 Mar 202603:26	–	attackerkb
CNNVD	WordPress Plugin App Builder – Create Native Android & iOS Apps On The Flight security vulnerabilities	21 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-2375 App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter	21 Mar 202603:26	–	cvelist
EUVD	EUVD-2026-14012	21 Mar 202606:30	–	euvd
NVD	CVE-2026-2375	21 Mar 202604:16	–	nvd
Patchstack	WordPress App Builder - Create Native Android & iOS Apps On The Flight plugin <= 5.5.10 - Unauthenticated Limited Privilege Escalation via 'role' Parameter vulnerability	23 Mar 202619:05	–	patchstack
Positive Technologies	PT-2026-26834	21 Mar 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-2375: Improper Privilege Management	21 Mar 202600:00	–	rapid7
RedhatCVE	CVE-2026-2375	26 Mar 202615:08	–	redhatcve
Vulnrichment	CVE-2026-2375 App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter	21 Mar 202603:26	–	vulnrichment

Vulners

Node

appcheap app_builderRange≤5.5.10wordpress

[
  {
    "vendor": "appcheap",
    "product": "App Builder – Create Native Android & iOS Apps On The Flight",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "5.5.10",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/app-builder/tags/5.5.10/includes/Di/Service/Auth/AuthTrails.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/0a4521af-692a-4a84-ba9b-1904a42786c1
plugins	www.plugins.trac.wordpress.org/browser/app-builder/tags/5.5.10/includes/Di/Service/Auth/RegisterAuth.php

Parameter	Position	Path	Description	CWE
role	request body	/wp-json/app-builder/v1/register	Unauthenticated users can register with the wcfm_vendor role via the register endpoint due to verify_role() whitelisting and direct assignment in wp_insert_user(), bypassing WCFM vendor approval.	CWE-269

17 Jun 2026 10:30Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.5

EPSS0.00291

SSVC

CWE-269