App Builder CVE-2026-94294

No authentication, authorization, or user interaction is required to reach either the write or the redirect behavior - the plugin fails to require auth before writing attacker-supplied data to one of its options, and a separate unauthenticated request redirects the visitor to a URI built from that stored value. Exploitation therefore works against default configurations of the App Builder WordPress plugin at any version before 5.7.1, with no special feature toggle named in the advisory. The practical limiting factor is impact scope, not access: the flaw yields only an attacker-controlled redirect (integrity-only), so real-world harm depends on a victim actually visiting the malicious redirect link (social-engineering/phishing delivery), and sites already updated to 5.7.1 or later are not affected.

All signals point to a moderate, not critical, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3 MEDIUM) describes fully remote, unauthenticated, low-complexity exploitation with no user interaction, but the impact is deliberately narrow: integrity-only (I:L) with no confidentiality (C:N) and no availability (A:N) effect. This is consistent with a stored open-redirect/option-tampering flaw rather than a code-execution or data-exposure bug. On the threat side, a public exploit exists (POC=YES, reported by WPScan), but the CVE is NOT in CISA KEV, so per the precision rules this is 'publicly available exploit code exists' - distinct from active exploitation. No EPSS probability was supplied, so automated-exploitation likelihood cannot be quantified from the input and should not be assumed. There is no SSVC decision data provided. Net: the easy, pre-auth reachability raises nuisance/abuse value (phishing, redirect-based token or OAuth abuse, reputation/SEO damage), but the integrity-only impact caps real-world severity well below a system-compromise priority. One conflict to flag: the input Tag 'Information Disclosure' is inconsistent with the CVSS confidentiality metric C:N - the described behavior is an open redirect, not information disclosure, so do not treat this as a data-leak bug on the strength of that tag.

An unauthenticated attacker sends a request that stores a malicious URI into one of the App Builder plugin's options, then lures a victim to the plugin's separate unauthenticated redirect endpoint, whose browser is sent to the attacker-controlled destination. Because a POC is publicly available from WPScan and no authentication, privileges, or complex conditions are required (AV:N/AC:L/PR:N), this is most plausibly weaponized for phishing or redirect-based credential/OAuth abuse rather than direct server compromise.