CVE-2026-3651 json
Build App Online <= 1.0.23 - Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-product' AJAX Action
published 2026-03-21 7 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-13984
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 25%
- public exploits
- 0
- none known
Summary
The Build App Online plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.23. This is due to the plugin registering the 'build-app-online-update-vendor-product' AJAX action via wp_ajax_nopriv_ without proper authentication checks, capability verification, or nonce validation in the update_vendor_product() function. The function accepts a user-supplied post ID from the request and calls wp_update_post() to modify the post_author field without validating whether the user has permission to modify the specified post. This makes it possible for unauthenticated attackers to modify the post_author of arbitrary posts to 0 (orphaning posts from their legitimate authors), or for authenticated attackers to claim ownership of any post by setting themselves as the author.
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected products
- hakeemnala Build App Online
Classification
- Weakness
-
- CWE-862 Missing Authorization
- Technology feeds
References
- wordfence.com /threat-intel/vulnerabilities/id/51564b26-0d7c-4499-9f5a-84f76c5a5e8a?source=cve
- plugins.trac.wordpress.org /browser/build-app-online/trunk/admin/class-build-app-online-admin.php#L565
- plugins.trac.wordpress.org /browser/build-app-online/tags/1.0.23/admin/class-build-app-online-admin.php#L565
- plugins.trac.wordpress.org /browser/build-app-online/trunk/admin/class-build-app-online-admin.php#L556
- plugins.trac.wordpress.org /browser/build-app-online/tags/1.0.23/admin/class-build-app-online-admin.php#L556
- plugins.trac.wordpress.org /browser/build-app-online/trunk/includes/class-build-app-online.php#L233
- plugins.trac.wordpress.org /browser/build-app-online/tags/1.0.23/includes/class-build-app-online.php#L233
Sources
- CVE List CVE-2026-3651
- NVD CVE-2026-3651
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.