What is the CVSS score of CVE-2026-2375?

CVE-2026-2375 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-2375?

Organizations using for WordPress is vulnerable to Privilege Escalation in all should be aware of notable risk from CVE-2026-2375, a improper privilege management vulnerability rated CVSS 6.5.

How to fix or mitigate CVE-2026-2375?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Privilege Escalation in all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP CVE-2026-2375

EUVD-2026-14012 MEDIUM

Improper Privilege Management (CWE-269)

2026-03-21 Wordfence

GHSA-9jv9-72rp-497f

Apple Google WordPress PHP Privilege Escalation

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14012

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.5

DescriptionCVE.org

The App Builder - Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.5.10. This is due to the verify_role() function in AuthTrails.php explicitly whitelisting the wcfm_vendor role alongside subscriber and customer, and assigning it directly via wp_insert_user() without integrating with WCFM Marketplace's vendor approval workflow. This makes it possible for unauthenticated attackers to register an account with the wcfm_vendor role by supplying the role parameter in the /wp-json/app-builder/v1/register REST API endpoint, bypassing the standard WCFM vendor approval process and immediately gaining vendor-level privileges (product management, order access, store management) on sites where WCFM Marketplace is active.

AnalysisAI

The App Builder - Create Native Android & iOS Apps On The Flight WordPress plugin up to version 5.5.10 contains a privilege escalation vulnerability in its REST API registration endpoint that allows unauthenticated attackers to register accounts with the wcfm_vendor role, bypassing WCFM Marketplace's vendor approval workflow. The verify_role() function in AuthTrails.php explicitly whitelists the wcfm_vendor role without proper authorization checks, enabling attackers to immediately gain vendor-level privileges including product management, order access, and store management on affected WordPress installations. This vulnerability has a CVSS score of 6.5 with low attack complexity and no authentication requirements, making it a moderate-to-significant risk for WordPress sites using both this plugin and WCFM Marketplace.

Technical ContextAI

The vulnerability exists in the App Builder plugin (CPE: cpe:2.3:a:appcheap:app_builder_–_create_native_android_&_ios_apps_on_the_flight:*:*:*:*:*:*:*:*) specifically within the verify_role() function located in includes/Di/Service/Auth/AuthTrails.php at line 80 and the user registration logic in RegisterAuth.php at line 108. The plugin exposes a REST API endpoint at /wp-json/app-builder/v1/register that accepts a role parameter. The root cause, classified under CWE-269 (Improper Access Control), stems from the lack of integration with WCFM Marketplace's vendor approval workflow. Instead of delegating vendor role assignment to WCFM's proper authorization mechanisms, the plugin directly whitelists wcfm_vendor alongside subscriber and customer roles and assigns them via wp_insert_user() without validating approval status, treating a privileged WordPress role as equivalent to a general-purpose role during registration.

RemediationAI

Upgrade the App Builder plugin to a version later than 5.5.10 where the verify_role() function has been patched to remove wcfm_vendor from the whitelisted roles during unauthenticated registration and/or properly integrate with WCFM Marketplace's vendor approval workflow. Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/0a4521af-692a-4a84-ba9b-1904a42786c1 provides detailed patch information and should be consulted for the exact patched version. As an interim mitigation, administrators can disable the /wp-json/app-builder/v1/register REST endpoint via firewall rules, disable the App Builder plugin entirely, or use a Web Application Firewall (WAF) to block requests containing the role parameter set to wcfm_vendor. Additionally, audit existing user accounts for unexpected vendors with wcfm_vendor roles created after the plugin installation date and remove unauthorized vendor accounts immediately.