Live › vulnerability › CVE-2026-94294
Go to dashboardThe App Builder WordPress plugin before 5.7.1 lets anyone without a login write attacker-supplied data into one of its options. A separate unauthenticated request then redirects the visitor's browser to a URI built from that stored data, enabling redirects to attacker-chosen sites.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the App Builder WordPress plugin older than are exposed, since the flaw needs no account and no setup beyond the plugin being present. Sites that have already moved to or later, or that do not run the plugin, can skip it.
5.7.15.7.1No product ranges from the sources yet.
wp plugin get app-builder --field=version (plugin slug unknown from sources; confirm the slug).5.7.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data.
This page as .md · .json · in your agent: get_signal("CVE-2026-94294")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.