What the vulnerability does
01Description
The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 5.6.0. This is due to missing authorization validation in the `upload_avatar()` function, which accepts an attacker-controlled `user_id` parameter from the POST request body and uses it to update user meta without verifying that the authenticated requester owns or has permission to modify the target account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the profile avatar of any arbitrary user on the site, including administrators, by supplying a target `user_id` in the request body to the `/wp-json/app-builder/v1/upload-avatar` endpoint.
Explanation of Vulnerability in Simple Terms
02Summary
App Builder versions up to 5.6.0 contain an integrity vulnerability accessible over the network without authentication. An attacker can modify data or content on the application, though confidentiality and availability are not affected. The exact attack vector is unclear due to incomplete vulnerability classification data.
What an attacker can do
03Attacker Capabilities
Modify application data or content without authentication.
Potential impact on your site
04Site Impact
Attackers can alter app data or configuration without logging in, potentially affecting app functionality or user trust.
Conditions required to exploit
05Prerequisites
Network access to the application; no authentication or user interaction required.
Key dates
06Disclosure timeline
May 2, 2026
CVE published
May 4, 2026
Record updated
