CVE-2026-94294
Received Received - Intake

Open Redirect via Stored Data in App Builder WordPress Plugin

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: WPScan

Description
The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-94294
EUVD
EUVD-2026-104107

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown App Builder 3.8.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the App Builder WordPress plugin allows unauthenticated attackers to write arbitrary data to a plugin option and then redirect visitors to a URL built from that data. It exists due to missing authorization checks in versions 3.8.4 to 5.7.0.

Detection Guidance

Check if the App Builder plugin version is between 3.8.4 and 5.7.0. Use commands like 'wp plugin list' in WordPress or inspect the plugin directory for version details. Look for unauthorized modifications to plugin options or unexpected redirects.

Impact Analysis

An attacker could manipulate plugin settings to redirect users to malicious websites, potentially leading to phishing attacks, malware downloads, or other security risks. Visitors to the site may be unknowingly sent to harmful destinations.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized data manipulation and redirection. Unauthenticated attackers could alter plugin settings to exfiltrate user data or redirect visitors to malicious sites, violating data protection and privacy requirements under these regulations.

Mitigation Strategies

Update the App Builder plugin to version 5.7.1 or later immediately. Remove or disable the plugin if an update is not possible. Monitor for unusual redirects or unauthorized changes to plugin settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94294. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart