appcheap App Builder Plugin up to 5.5.10 on WordPress REST API Endpoint AuthTrails.php verify_role privileges management

Summaryinfo

A vulnerability, which was classified as critical, was found in appcheap App Builder Plugin up to 5.5.10 on WordPress. The impacted element is the function verify_role of the file AuthTrails.php of the component REST API Endpoint. Such manipulation leads to privileges management. This vulnerability is uniquely identified as CVE-2026-2375. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in appcheap App Builder Plugin up to 5.5.10 on WordPress. Affected by this issue is the function verify_role of the file AuthTrails.php of the component REST API Endpoint. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.5.10. This is due to the `verify_role()` function in `AuthTrails.php` explicitly whitelisting the `wcfm_vendor` role alongside `subscriber` and `customer`, and assigning it directly via `wp_insert_user()` without integrating with WCFM Marketplace's vendor approval workflow. This makes it possible for unauthenticated attackers to register an account with the `wcfm_vendor` role by supplying the `role` parameter in the `/wp-json/app-builder/v1/register` REST API endpoint, bypassing the standard WCFM vendor approval process and immediately gaining vendor-level privileges (product management, order access, store management) on sites where WCFM Marketplace is active.

The weakness was disclosed by Gibran Abdillah. The advisory is shared for download at wordfence.com. This vulnerability is handled as CVE-2026-2375 since 02/11/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

By approaching the search of inurl:AuthTrails.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 5.5.10 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• appcheap

Name

• App Builder Plugin

Version

• 5.5.0
• 5.5.1
• 5.5.2
• 5.5.3
• 5.5.4
• 5.5.5
• 5.5.6
• 5.5.7
• 5.5.8
• 5.5.9
• 5.5.10

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion