App Builder
Monthly
The App Builder WordPress plugin before 5.7.1 writes attacker-supplied data into one of its options without any authentication or authorization check, and a second unauthenticated request then redirects the visitor's browser to a URI built from that stored value. The result is an unauthenticated, persistent open redirect (CVSS 5.3, integrity-only) that remote attackers can use to bounce victims to attacker-chosen destinations, typically as a phishing delivery step. Publicly available exploit code exists, but the real-world impact is bounded because a victim must actually follow the crafted link; sites running 5.7.1 or later are not affected.
Arbitrary file overwrite in Develar app-builder (all versions ≤ 4.2.0 on macOS) allows an unauthenticated remote attacker to escape the ZIP extraction directory by exploiting APFS Unicode case-folding combined with symlink following in the `zipx.Unzip` routine. A crafted archive containing a symlink entry `ss` pointing to an external victim file and a subsequent regular-file entry `ß` causes the builder to follow the symlink - because APFS folds `ß` to `ss` - overwriting the target with attacker-controlled content. SSVC rates the attack automatable with no confirmed exploitation; no public exploit code has been identified at time of analysis, though CERT/CC advisory VU#293714 and ENISA EUVD-2026-50423 confirm coordinated disclosure.
The App Builder - Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.3.7. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The App Builder - Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to limited SQL Injection via the ‘app-builder-search’ parameter in all versions up to, and. Rated medium severity (CVSS 5.6), this vulnerability is remotely exploitable, no authentication required.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Appcheap.Io App Builder.8.7. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The App Builder WordPress plugin before 5.7.1 writes attacker-supplied data into one of its options without any authentication or authorization check, and a second unauthenticated request then redirects the visitor's browser to a URI built from that stored value. The result is an unauthenticated, persistent open redirect (CVSS 5.3, integrity-only) that remote attackers can use to bounce victims to attacker-chosen destinations, typically as a phishing delivery step. Publicly available exploit code exists, but the real-world impact is bounded because a victim must actually follow the crafted link; sites running 5.7.1 or later are not affected.
Arbitrary file overwrite in Develar app-builder (all versions ≤ 4.2.0 on macOS) allows an unauthenticated remote attacker to escape the ZIP extraction directory by exploiting APFS Unicode case-folding combined with symlink following in the `zipx.Unzip` routine. A crafted archive containing a symlink entry `ss` pointing to an external victim file and a subsequent regular-file entry `ß` causes the builder to follow the symlink - because APFS folds `ß` to `ss` - overwriting the target with attacker-controlled content. SSVC rates the attack automatable with no confirmed exploitation; no public exploit code has been identified at time of analysis, though CERT/CC advisory VU#293714 and ENISA EUVD-2026-50423 confirm coordinated disclosure.
The App Builder - Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.3.7. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The App Builder - Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to limited SQL Injection via the ‘app-builder-search’ parameter in all versions up to, and. Rated medium severity (CVSS 5.6), this vulnerability is remotely exploitable, no authentication required.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Appcheap.Io App Builder.8.7. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.