CVE-2026-7638

🗓️ 02 May 2026 03:36:42Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 9 Views🌐 WEB

Insecure direct object reference in App Builder lets authenticated users change any avatar via user_id.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-7638	2 May 202603:36	–	attackerkb
Circl	CVE-2026-7638	3 May 202620:28	–	circl
CNNVD	WordPress plugin App Builder – Create Native Android & iOS Apps On The Flight 安全漏洞	2 May 202600:00	–	cnnvd
Cvelist	CVE-2026-7638 App Builder <= 5.5.10 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameter	2 May 202603:36	–	cvelist
EUVD	EUVD-2026-26732	2 May 202603:36	–	euvd
NVD	CVE-2026-7638	2 May 202604:16	–	nvd
Patchstack	WordPress App Builder – Create Native Android & iOS Apps On The Flight plugin <= 5.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification vulnerability	1 May 202615:33	–	patchstack
Positive Technologies	PT-2026-36563	2 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-7638	4 May 202620:21	–	redhatcve
Vulnrichment	CVE-2026-7638 App Builder <= 5.5.10 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameter	2 May 202603:36	–	vulnrichment

Vulners

Node

appcheap app_builder_create_native_android_&_ios_apps_on_the_flightRange≤5.6.0wordpress

[
  {
    "vendor": "appcheap",
    "product": "App Builder – Create Native Android & iOS Apps On The Flight",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "5.6.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/2d532ffc-c6f1-41e3-9a59-0706802ab8e2
plugins	www.plugins.trac.wordpress.org/browser/app-builder/trunk/includes/Di/Service/Auth/UploadAvatar.php
plugins	www.plugins.trac.wordpress.org/browser/app-builder/trunk/includes/Di/Service/Auth/UploadAvatar.php
plugins	www.plugins.trac.wordpress.org/browser/app-builder/tags/5.6.0/includes/Di/Service/Auth/UploadAvatar.php
plugins	www.plugins.trac.wordpress.org/browser/app-builder/trunk/includes/Traits/Permission.php
plugins	www.plugins.trac.wordpress.org/browser/app-builder/tags/5.5.10/includes/Di/Service/Auth/UploadAvatar.php
plugins	www.plugins.trac.wordpress.org/browser/app-builder/tags/5.5.10/includes/Traits/Permission.php
plugins	www.plugins.trac.wordpress.org/browser/app-builder/tags/5.5.10/includes/Di/Service/Auth/UploadAvatar.php
plugins	www.plugins.trac.wordpress.org/browser/app-builder/tags/5.6.0/includes/Traits/Permission.php
plugins	www.plugins.trac.wordpress.org/browser/app-builder/tags/5.6.0/includes/Di/Service/Auth/UploadAvatar.php

Parameter	Position	Path	Description	CWE
user_id	request body	/wp-json/app-builder/v1/upload-avatar	Insecure Direct Object Reference: authenticated attackers with Subscriber-level access can specify a target user_id in the upload-avatar request body to overwrite the avatar of arbitrary users without proper authorization.	CWE-639

17 Jun 2026 11:02Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.3

EPSS0.00306

SSVC

CWE-639