CVE-2026-94294
App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php
Unknown App Builder
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 5.7.1App BuilderCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data.
Text from CVE List
Affected versions 1
- App Builderaffected: 3.8.4 before 5.7.1CVE List