CVE-2026-11882: Builderall WordPress Auth Bypass Flaw

CVE-2026-11882 Overview

CVE-2026-11882 affects the Builderall for WordPress plugin in versions prior to 3.0.2. The plugin fails to bind the OAuth state parameter on its public authentication routes to the initiating user session. Unauthenticated attackers can complete the OAuth connection flow and overwrite the stored third-party integration access token on a target site. A durable overwrite requires the target site to already be connected to a paid Builderall account. The flaw is categorized under [CWE-284: Improper Access Control].

Critical Impact
Unauthenticated attackers can overwrite a site's Builderall integration access token by hijacking the OAuth callback flow, redirecting future integration data to an attacker-controlled account.

Affected Products

Builderall for WordPress plugin versions prior to 3.0.2
WordPress sites with an active paid Builderall account connection
Sites exposing the plugin's public OAuth authentication routes

Discovery Timeline

2026-08-01 - CVE-2026-11882 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-11882

Vulnerability Analysis

The Builderall for WordPress plugin implements an OAuth 2.0 client for connecting a WordPress site to a Builderall account. OAuth flows use a state parameter to prevent Cross-Site Request Forgery (CSRF) during the redirect handshake. In affected versions, the plugin generates and validates a state value but does not tie it to the WordPress session that initiated the request. Any visitor who reaches the public callback endpoint with a valid-looking state can complete the flow. On success, the plugin stores the returned access token as the site's integration credential, replacing any token previously saved by an administrator.

Root Cause

The root cause is missing session binding on the OAuth state value. The plugin treats state as a global nonce rather than a per-session anti-CSRF token. Because the callback route is unauthenticated and publicly reachable, verification succeeds regardless of who triggers it. This is a classic access control failure aligned with [CWE-284].

Attack Vector

An attacker initiates the Builderall OAuth flow against their own account, captures the state and authorization code, and submits them to the target site's public callback URL. The plugin accepts the callback, exchanges the code, and overwrites the stored integration token. High attack complexity reflects timing and preconditions: the target must already be linked to a paid Builderall account for the overwrite to persist. Successful exploitation yields limited integrity impact by redirecting third-party integration operations to attacker-controlled infrastructure. No verified proof-of-concept code is publicly available. See the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-11882

Indicators of Compromise

Unexpected requests to the plugin's OAuth callback route from IP addresses not associated with site administrators
Changes to the stored Builderall integration token in wp_options without a corresponding administrator action in audit logs
Outbound integration traffic to Builderall API endpoints referencing an unfamiliar account identifier

Detection Strategies

Review WordPress access logs for GET requests to the Builderall OAuth callback endpoint containing code and state query parameters
Correlate callback hits with authenticated admin sessions; unauthenticated hits that precede an option update are suspicious
Compare the currently connected Builderall account identifier against the account originally provisioned by the site owner

Monitoring Recommendations

Enable WordPress audit logging on update_option events for Builderall plugin option keys
Alert when the plugin's stored access token changes outside of a known administrator workflow
Monitor egress traffic patterns to Builderall API domains for changes in destination tenant or account context

How to Mitigate CVE-2026-11882

Immediate Actions Required

Upgrade the Builderall for WordPress plugin to version 3.0.2 or later on all affected sites
Disconnect and reconnect the Builderall integration after upgrading to invalidate any attacker-planted access token
Rotate any Builderall account credentials or API keys that may have been exposed through the compromised integration

Patch Information

The vendor addressed the issue in Builderall for WordPress version 3.0.2 by binding the OAuth state value to the initiating user session. Refer to the WPScan Vulnerability Report for advisory details and fixed-version metadata.

Workarounds

Deactivate the Builderall plugin until the site can be upgraded to 3.0.2
Restrict access to the plugin's OAuth callback route with a web application firewall (WAF) rule limiting requests to known administrator IP ranges
Temporarily disconnect the site from any paid Builderall account so that a token overwrite cannot persist

bash

# Example WAF rule concept: restrict Builderall OAuth callback to admin IPs
# Adjust the URI pattern to match the plugin's actual callback route.
location ~* /wp-json/builderall/.*/oauth/callback {
    allow 203.0.113.10;   # admin workstation
    allow 198.51.100.0/24; # office range
    deny all;
}