[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$feE69v0IzQMiRLFzo76XoikS_GZ9bpwcwJusETujk9Xo":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":24,"research_vulnerable_code":25,"research_fix_diff":26,"research_exploit_outline":27,"research_model_used":28,"research_started_at":29,"research_completed_at":30,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":31},"CVE-2026-7638","app-builder-insecure-direct-object-reference-to-authenticated-subscriber-arbitrary-user-avatar-modification-via-userid-p","App Builder \u003C= 5.5.10 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameter","The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Insecure Direct Object Reference  in all versions up to and including 5.6.0. This is due to missing authorization validation in the `upload_avatar()` function, which accepts an attacker-controlled `user_id` parameter from the POST request body and uses it to update user meta without verifying that the authenticated requester owns or has permission to modify the target account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the profile avatar of any arbitrary user on the site, including administrators, by supplying a target `user_id` in the request body to the `\u002Fwp-json\u002Fapp-builder\u002Fv1\u002Fupload-avatar` endpoint.","app-builder",null,"\u003C=5.6.0","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Authorization Bypass Through User-Controlled Key","2026-05-01 15:33:11","2026-05-02 03:36:42",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F2d532ffc-c6f1-41e3-9a59-0706802ab8e2?source=api-prod",[],"researched",false,3,"# Exploitation Research Plan - CVE-2026-7638\n\n## 1. Vulnerability Summary\nThe **App Builder** plugin (\u003C= 5.6.0) for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in its REST API implementation. The function `upload_avatar()` handles requests to the `\u002Fwp-json\u002Fapp-builder\u002Fv1\u002Fupload-avatar` endpoint but fails to perform an authorization check to ensure the authenticated user has permission to modify the target `user_id`. Consequently, any authenticated user (Subscriber level and above) can change the profile avatar of any other user, including administrators, by specifying the target's ID in the request.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `\u002Fwp-json\u002Fapp-builder\u002Fv1\u002Fupload-avatar`\n- **Method:** `POST`\n- **Authentication:** Required (Subscriber or higher).\n- **Vulnerable Parameter:** `user_id` (passed in the POST body).\n- **Payload:** An image file (multipart\u002Fform-data) or an attachment ID, along with the target `user_id`.\n- **Preconditions:** The attacker must have valid credentials for a Subscriber-level account.\n\n## 3. Code Flow (Inferred from Description)\n1. **Route Registration:** During `rest_api_init`, the plugin registers the route:\n   ```php\n   register_rest_route('app-builder\u002Fv1', '\u002Fupload-avatar', [\n       'methods' => 'POST',\n       'callback' => 'upload_avatar', \u002F\u002F Likely a method in a controller class\n       'permission_callback' => 'is_user_logged_in' \u002F\u002F VULNERABLE: Only checks if logged in, not permissions\n   ]);\n   ```\n2. **Handler Execution:** The `upload_avatar($request)` function is called.\n3. **Parameter Extraction:** The function retrieves the target user ID from the request:\n   ```php\n   $user_id = $request->get_param('user_id'); \n   ```\n4. **Sink (Missing Check):** Without verifying if the current user ID matches `$user_id` or if the current user is an administrator, the function processes the upload:\n   ```php\n   \u002F\u002F Missing: if (get_current_user_id() != $user_id && !current_user_can('edit_users')) { return error; }\n   \u002F\u002F Logic to handle file upload and update user meta\n   update_user_meta($user_id, 'app_builder_user_avatar', $avatar_url); \u002F\u002F Example meta key\n   ```\n\n## 4. Nonce Acquisition Strategy\nThe WordPress REST API requires a nonce for authenticated requests to prevent CSRF. This nonce is typically tied to the `wp_rest` action.\n\n1. **Login:** Authenticate as a Subscriber user.\n2. **Access Admin Context:** Navigate to `wp-admin\u002F` or a page where the plugin is active.\n3. **Extract Nonce:** Use the `browser_eval` tool to extract the nonce from the global `wpApiSettings` object provided by WordPress core.\n   - **Script:** `browser_eval(\"window.wpApiSettings?.nonce\")`\n4. **Alternative (if standard REST nonce is blocked):** Check for localized scripts specific to App Builder by searching for `wp_localize_script` in the plugin source (e.g., `app_builder_settings`).\n\n## 5. Exploitation Strategy\n1. **Login:** Perform a login request as a Subscriber.\n2. **Obtain Nonce:** Extract the `X-WP-Nonce` from the `wpApiSettings` via a browser session.\n3. **Identify Target:** Target `user_id = 1` (the default administrator).\n4. **Construct Request:**\n   - **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-json\u002Fapp-builder\u002Fv1\u002Fupload-avatar`\n   - **Headers:** \n     - `X-WP-Nonce: [EXTRACTED_NONCE]`\n     - `Content-Type: multipart\u002Fform-data`\n   - **Body:**\n     - `user_id`: `1`\n     - `avatar`: (A small valid image file, e.g., `exploit.png`)\n5. **Execute:** Send the request using the `http_request` tool.\n\n## 6. Test Data Setup\n1. **Users:**\n   - Ensure an administrator exists (usually ID 1).\n   - Create a Subscriber user: `wp user create attacker attacker@example.com --role=subscriber --user_pass=password123`.\n2. **Plugin:** Ensure \"App Builder\" is active.\n3. **File:** Prepare a dummy image file `avatar.jpg` in the environment.\n\n## 7. Expected Results\n- The server should return a `200 OK` or `201 Created` response.\n- The response body may contain the URL of the new avatar.\n- The administrator's user meta (specifically the one used by App Builder for avatars) will be updated to point to the attacker's uploaded file.\n\n## 8. Verification Steps\n1. **Check User Meta via CLI:**\n   - Run: `wp user meta list 1`\n   - Look for keys related to `avatar` or `app-builder` (e.g., `app_builder_avatar`).\n2. **Confirm Value Change:**\n   - Verify that the meta value for the admin (ID 1) now matches the path of the file uploaded by the subscriber.\n   - Command: `wp user meta get 1 [META_KEY]`\n\n## 9. Alternative Approaches\n- **JSON Payload:** If `multipart\u002Fform-data` fails, attempt a raw JSON POST if the plugin accepts an attachment ID or URL:\n  ```json\n  {\n    \"user_id\": 1,\n    \"avatar\": \"http:\u002F\u002Fattacker.com\u002Fmalicious-avatar.png\"\n  }\n  ```\n- **Direct Parameter Injection:** If the route is processed differently, try passing `user_id` as a query parameter: `\u002Fwp-json\u002Fapp-builder\u002Fv1\u002Fupload-avatar?user_id=1`.\n- **Meta Key Guessing:** If the specific meta key is unknown, use `wp user meta list 1` before and after the exploit to identify which key changed.","The App Builder plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in its REST API avatar upload functionality. Authenticated users with Subscriber-level access can overwrite the profile avatar of any user, including administrators, by specifying a target user_id in a request to the \u002Fwp-json\u002Fapp-builder\u002Fv1\u002Fupload-avatar endpoint without proper authorization checks.","\u002F\u002F Inferred from research plan as source files were not provided\n\u002F\u002F Path: app-builder\u002Fincludes\u002Fclass-app-builder-rest-api.php (or similar)\n\nregister_rest_route('app-builder\u002Fv1', '\u002Fupload-avatar', [\n    'methods' => 'POST',\n    'callback' => 'upload_avatar',\n    'permission_callback' => 'is_user_logged_in' \u002F\u002F VULNERABLE: Only checks if user is logged in\n]);\n\n---\n\npublic function upload_avatar($request) {\n    $user_id = $request->get_param('user_id'); \u002F\u002F ID is taken directly from user input\n    \n    \u002F\u002F Missing validation: if (get_current_user_id() != $user_id && !current_user_can('edit_users')) { ... }\n    \n    $avatar_url = $this->handle_upload($request);\n    update_user_meta($user_id, 'app_builder_user_avatar', $avatar_url);\n    return new WP_REST_Response(['success' => true, 'url' => $avatar_url], 200);\n}","--- a\u002Fapp-builder\u002Fincludes\u002Fclass-app-builder-rest-api.php\n+++ b\u002Fapp-builder\u002Fincludes\u002Fclass-app-builder-rest-api.php\n@@ -10,7 +10,14 @@\n         register_rest_route('app-builder\u002Fv1', '\u002Fupload-avatar', [\n             'methods' => 'POST',\n             'callback' => [$this, 'upload_avatar'],\n-            'permission_callback' => 'is_user_logged_in'\n+            'permission_callback' => function($request) {\n+                if (!is_user_logged_in()) return false;\n+                $user_id = $request->get_param('user_id');\n+                if (get_current_user_id() == $user_id || current_user_can('edit_users')) {\n+                    return true;\n+                }\n+                return new WP_Error('rest_forbidden', __('You do not have permission to edit this user.'), ['status' => 403]);\n+            }\n         ]);\n     }","1. Login to the WordPress site as a user with Subscriber-level permissions.\n2. Obtain a valid WordPress REST API nonce (X-WP-Nonce) from the front-end (e.g., via the window.wpApiSettings.nonce object).\n3. Prepare a POST request to \u002Fwp-json\u002Fapp-builder\u002Fv1\u002Fupload-avatar using multipart\u002Fform-data content type.\n4. In the request body, set the 'user_id' parameter to the ID of the target user (e.g., '1' for the primary administrator).\n5. Attach a valid image file to the request (e.g., 'avatar' field).\n6. Send the request; the plugin will process the upload and update the user_meta for the specified 'user_id' to point to the attacker's uploaded image, effectively changing the target's profile picture.","gemini-3-flash-preview","2026-05-04 17:21:24","2026-05-04 17:21:41",{"type":32,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":33},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fapp-builder\u002Ftags"]