CVE-2026-11882
Received Received - Intake

Builderall for WordPress OAuth Token Overwrite Vulnerability

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: WPScan

Description
The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable overwrite requires the site to already be connected to a paid account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-11882
EUVD
EUVD-2026-51697

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
builderall builderall_for_wordpress to 3.0.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Builderall for WordPress plugin before version 3.0.2 has a flaw in its OAuth authentication process. Public routes used for OAuth do not properly link the state value to the user's session. This allows attackers to complete the OAuth connection without authentication and overwrite stored access tokens for third-party integrations.

Detection Guidance

Check if the Builderall for WordPress plugin version is below 3.0.2. Inspect OAuth authentication routes for improper state binding. Review third-party integration access tokens for unauthorized changes.

Impact Analysis

Unauthenticated attackers could gain control over third-party integration tokens, potentially accessing or modifying data from connected services. This requires the site to already be connected to a paid account for a durable overwrite.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to third-party integration tokens. If an attacker overwrites these tokens, they may gain access to sensitive user data processed through these integrations, violating data protection requirements under GDPR and HIPAA.

Mitigation Strategies

Update the Builderall for WordPress plugin to version 3.0.2 or later to address the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11882. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart