What is the CVSS score of CVE-2026-3651?

CVE-2026-3651 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-3651?

Organizations using for WordPress is vulnerable to unauthorized access in all should be aware of moderate risk from CVE-2026-3651, a missing authorization vulnerability rated CVSS 5.3.

How to fix or mitigate CVE-2026-3651?

Within 30 days: Identify affected systems running for WordPress is vulnerable to unauthorized access in all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-3651

EUVD-2026-13984 MEDIUM

Missing Authorization (CWE-862)

2026-03-21 Wordfence

GHSA-xcmm-m27h-87pr

WordPress Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-13984

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 5.3

DescriptionCVE.org

The Build App Online plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.23. This is due to the plugin registering the 'build-app-online-update-vendor-product' AJAX action via wp_ajax_nopriv_ without proper authentication checks, capability verification, or nonce validation in the update_vendor_product() function. The function accepts a user-supplied post ID from the request and calls wp_update_post() to modify the post_author field without validating whether the user has permission to modify the specified post. This makes it possible for unauthenticated attackers to modify the post_author of arbitrary posts to 0 (orphaning posts from their legitimate authors), or for authenticated attackers to claim ownership of any post by setting themselves as the author.

AnalysisAI

The Build App Online WordPress plugin contains an authentication bypass vulnerability in the 'build-app-online-update-vendor-product' AJAX action that allows unauthenticated attackers to modify post metadata without authorization. Affected versions are up to and including 1.0.23 as confirmed via CPE (cpe:2.3:a:hakeemnala:build_app_online). Attackers can orphan posts by setting the post_author field to 0 or, if authenticated, claim ownership of arbitrary posts by reassigning authorship, resulting in unauthorized content modification with medium integrity impact (CVSS 5.3).

Technical ContextAI

The vulnerability exists in the WordPress plugin architecture where the update_vendor_product() function in class-build-app-online-admin.php registers an AJAX action via wp_ajax_nopriv_ hook, which explicitly allows unauthenticated access to AJAX endpoints. The root cause is classified under CWE-862 (Missing Authorization) due to absent capability verification and nonce validation. The vulnerable code path accepts a user-supplied post ID parameter and directly calls wp_update_post() without first verifying that the current user has permission to modify the target post's metadata. This represents a fundamental authorization control bypass in the WordPress security model, where AJAX actions should validate both user identity and capabilities before processing sensitive operations like post modifications.

RemediationAI

Upgrade the Build App Online plugin to a version newer than 1.0.23 immediately, as the vulnerability is present in all prior versions. Visit the WordPress plugin repository or the vendor's update mechanism to obtain the patched version. If an immediate patch is unavailable, implement the following compensating controls: disable the plugin entirely until a fix is available; use WordPress security plugins to implement additional AJAX request validation and nonce checking; restrict AJAX endpoint access via Web Application Firewall (WAF) rules to authenticated users only; and regularly audit post authorship changes via WordPress logs to detect unauthorized modifications. Reference the vulnerability via Wordfence Threat Intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/51564b26-0d7c-4499-9f5a-84f76c5a5e8a and review the vulnerable code at https://plugins.trac.wordpress.org/browser/build-app-online/tags/1.0.23/admin/class-build-app-online-admin.php#L565.