LiveActive security incident?Get immediate response
CVE Record

CVE-2026-3651: Build App Online <= 1.0.23 - Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-product' AJAX Action

The Build App Online plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.23. This is due to the plugin registering the 'build-app-online-update-vendor-product' AJAX action via wp_ajax_nopriv_ without proper authentication checks, capability verification, or nonce validation in the update_vendor_product() function. The function accepts a user-supplied post ID from the request and calls wp_update_post() to modify the post_author field without validating whether the user has permission to modify the specified post. This makes it possible for unauthenticated attackers to modify the post_author of arbitrary posts to 0 (orphaning posts from their legitimate authors), or for authenticated attackers to claim ownership of any post by setting themselves as the author.

MediumCVSS 5.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2026-3651 affects the Build App Online WordPress plugin through version 1.0.23. An unauthenticated visitor can trigger an AJAX function that changes the author of posts without permission checks. Business impact is content ownership/integrity damage, not server takeover. No active exploitation is reported in the provided sources.

Executive priority

Treat as a moderate-priority integrity issue. Prioritize sites where content authorship affects publishing workflow, vendor products, compliance records, or customer trust. It does not indicate data theft or remote code execution based on current sources.

Technical view

The plugin registers build-app-online-update-vendor-product through wp_ajax_nopriv_ and the update_vendor_product() function lacks authentication, capability checks, and nonce validation. It accepts a request-supplied post ID and calls wp_update_post() to change post_author. CVSS is 5.3, network exploitable, low complexity, no privileges or user interaction required, with low integrity impact.

Likely exposure

Exposure is limited to WordPress sites running Build App Online versions up to and including 1.0.23. Publicly reachable WordPress admin-ajax.php increases reachability because the vulnerable action is registered for unauthenticated users.

Exploitation context

The vulnerability can let unauthenticated attackers orphan posts by setting post_author to 0, or authenticated attackers claim ownership of posts. The provided sources do not show KEV listing, public exploitation, or a vendor-fixed version.

Researcher notes

Key evidence is in Wordfence and WordPress Trac references showing the AJAX registration and update function. The source bundle states affected versions through 1.0.23, but does not provide a named patch version. Avoid claiming active exploitation without additional evidence.

Mitigation direction

  • Inventory WordPress sites for the Build App Online plugin and version.
  • Disable or remove the plugin where it is not business-critical.
  • Check vendor or WordPress plugin guidance for a fixed release.
  • Apply an official update if one is published.
  • Review post authorship integrity after suspected exposure.

Validation and detection

  • Confirm whether Build App Online is installed on each WordPress site.
  • Verify plugin version is greater than 1.0.23, if available.
  • Review code for authentication, capability, and nonce checks around the AJAX action.
  • Audit recent post_author changes for unexpected ownership changes.
  • Monitor admin-ajax.php traffic for the named action.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-862: Authorization and privilege behavior lookup

Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-3651 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.3CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N3.91.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.3Medium
CVSS 3.1 vector shape for CVE-2026-3651Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
hakeemnalaBuild App Online0unaffected
Weakness

CWE details

CWE-862

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-862 · source CWE mapping

Missing Authorization

Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs