CVE-2026-2375: Privilege Escalation in App Builder WordPress Plugin

The primary impact of CVE-2026-2375 is the ability for an attacker to gain unauthorized access and control within a WordPress site utilizing the App Builder plugin. By registering with the wcfm_vendor role, an attacker could potentially manipulate product listings, access sensitive vendor data, or even modify site configurations depending on the permissions associated with that role. This could lead to data breaches, financial losses, and reputational damage. The lack of vendor approval integration means that the plugin does not properly validate the legitimacy of new vendor accounts, creating a direct pathway for malicious actors.

1. Reserved2026-02-11
2. Published2026-03-21
3. Modified2026-04-08
4. EPSS updated2026-03-28

The immediate mitigation for CVE-2026-2375 is to upgrade to a patched version of the App Builder plugin as soon as it becomes available. Until a patch is released, consider disabling the plugin entirely to prevent exploitation. As a temporary workaround, administrators can manually review and approve all new user registrations, specifically scrutinizing those requesting the wcfm_vendor role. Implementing a Web Application Firewall (WAF) with rules to block suspicious registration attempts targeting the /wp-json/app-bu endpoint could also provide an additional layer of defense. Monitor WordPress logs for unusual user registration patterns and role assignments.

Active installs

800

Plugin rating