{"id":"CVE-2026-94294","kind":"vulnerability","aliases":["CVE-2026-94294"],"related":[],"title":"App Builder WordPress plugin: unauthenticated option write enables visitor redirects","description":"The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data.","summary":"The App Builder WordPress plugin before 5.7.1 lets anyone without a login write attacker-supplied data into one of its options. A separate unauthenticated request then redirects the visitor's browser to a URI built from that stored data, enabling redirects to attacker-chosen sites.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wordpress-plugin"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed App Builder plugin version in the WordPress admin plugins list or with `wp plugin get app-builder --field=version` (plugin slug unknown from sources; confirm the slug).\n- unknown for other checks; the sources do not say which option is written.","fix":"- Update the App Builder WordPress plugin to `5.7.1` or later.\n- unknown for interim mitigations; the sources do not say.","status":"open","published_at":"2026-10-19T07:16:32+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:26:29+00:00","updated_at":"2026-10-25T04:26:29+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:26:29Z","model":"claude-haiku-5-5","output":{"fix":"- Update the App Builder WordPress plugin to `5.7.1` or later.\n- unknown for interim mitigations; the sources do not say.","reach":"internet","title":"App Builder WordPress plugin: unauthenticated option write enables visitor redirects","impact":"low","summary":"The App Builder WordPress plugin before 5.7.1 lets anyone without a login write attacker-supplied data into one of its options. A separate unauthenticated request then redirects the visitor's browser to a URI built from that stored data, enabling redirects to attacker-chosen sites.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin"],"confidence":0.6,"needs_auth":"no","worst_case":"Visitors are redirected to attacker-chosen sites via the stored value.","analyst_note":"Confirm the plugin slug and which option is written, and check the NVD entry for any exploit details or interim workaround.","how_to_check":"- Check the installed App Builder plugin version in the WordPress admin plugins list or with `wp plugin get app-builder --field=version` (plugin slug unknown from sources; confirm the slug).\n- unknown for other checks; the sources do not say which option is written.","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Sites running the App Builder WordPress plugin older than `5.7.1` are exposed, since the flaw needs no account and no setup beyond the plugin being present. Sites that have already moved to `5.7.1` or later, or that do not run the plugin, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000623,"input_tokens":3298,"output_tokens":587,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-94294':13A,16A '5.7.1':28B,75C 'anyon':30B 'app':1A,23B,70C 'attack':36B,66B,85C 'attacker-chosen':65B 'attacker-suppli':35B,84C 'authent':79C 'authoris':81C 'browser':53B,103C 'builder':2A,24B,71C 'built':57B,107C 'chosen':67B 'cve':11A,14A 'data':38B,61B,87C,111C 'enabl':8A,62B 'let':29B 'login':33B 'one':40B,89C 'option':6A,43B,92C 'packag':17B 'plugin':4A,21B,26B,73C 'redirect':10A,49B,63B,99C 'request':47B,98C 'requir':78C 'separ':45B,96C 'site':68B 'store':60B,110C 'suppli':37B,86C 'unauthent':5A,46B,97C 'uri':56B,106C 'visitor':9A,51B,101C 'without':31B 'wordpress':3A,18B,20B,25B,72C 'wordpress-plugin':19B 'write':7A,34B,83C","nicknames":[],"mitigations":[],"who_affected":"Sites running the App Builder WordPress plugin older than `5.7.1` are exposed, since the flaw needs no account and no setup beyond the plugin being present. Sites that have already moved to `5.7.1` or later, or that do not run the plugin, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T07:16:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94294","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94294","severity":null,"published_at":"2026-10-19T07:16:32+00:00","modified_at":"2026-10-19T21:02:51+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}