CVE-2026-94294: App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php
Published Oct 19, 2026
·Updated
The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data.
Affected Software
1 affected component
App Builder App Builder WordPress plugin>=3.8.4<=5.7.0
Event History
Oct 19, 2026
CVE Published
via MITRE·06:46 AM
Data Sourced
via MITRE·06:46 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which plugin versions are affected?
App Builder WordPress plugin versions 3.8.4 through 5.7.0 are affected. Versions before 5.7.1 are described as vulnerable.
2
Does exploitation require an account or user interaction?
No. The issue can be exploited through unauthenticated requests and does not require privileges or user interaction from the attacker.
3
What can an attacker do with this flaw?
An attacker can write attacker-controlled data to a plugin option. In a separate unauthenticated request, that stored data can be used to redirect a visitor's browser to an attacker-controlled URI.