What the vulnerability does
01Description
The Your Friendly Drag and Drop Page Builder — Make Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.10 via the make_builder_ajax_subscribe() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Explanation of Vulnerability in Simple Terms
02Summary
Make Builder versions up to 1.1.10 contain a server-side request forgery vulnerability. An authenticated user with low privileges can make the site send HTTP requests to internal or external systems on the attacker's behalf. The vulnerability affects the page builder's request handling and can expose internal services or data. Update to a version newer than 1.1.10.
What an attacker can do
03Attacker Capabilities
Make the site send HTTP requests to internal systems or external URLs controlled by the attacker.
Potential impact on your site
04Site Impact
Attackers with user accounts can probe internal infrastructure, access private APIs, or exfiltrate data via the page builder.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site; no user interaction required.
Key dates
06Disclosure timeline
March 22, 2025
CVE published
April 8, 2026
Record updated
