CVE-2026-2375: App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter
The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.5.10. This is due to the verifyrole() function in AuthTrails.php explicitly whitelisting the wcfmvendor role alongside subscriber and customer, and assigning it directly via wpinsertuser() without integrating with WCFM Marketplace's vendor approval workflow. This makes it possible for unauthenticated attackers to register an account with the wcfmvendor role by supplying the role parameter in the /wp-json/app-builder/v1/register REST API endpoint, bypassing the standard WCFM vendor approval process and immediately gaining vendor-level privileges (product management, order access, store management) on sites where WCFM Marketplace is active.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to meaningful impact?
Sites running the affected App Builder plugin version 5.5.10 or earlier are vulnerable. The vendor-level impact described requires WCFM Marketplace to be active, because the escalated role is wcfm_vendor.
What does an attacker need to exploit this issue?
No authentication or user interaction is required. An attacker can submit a registration request to the /wp-json/app-builder/v1/register REST API endpoint and supply role=wcfm_vendor.
What access could a successful attacker obtain?
The attacker can immediately receive the wcfm_vendor role without going through WCFM Marketplace's vendor approval workflow. This provides vendor-level capabilities including product management, order access, and store management.
How can I check whether the vulnerable behavior applies to my site?
Check whether App Builder is installed at version 5.5.10 or earlier and whether WCFM Marketplace is active. Also review accounts assigned the wcfm_vendor role for registrations that did not follow the expected vendor approval process.