CVE-2026-3651: Build App Online Auth Bypass Vulnerability

CVE-2026-3651 Overview

The Build App Online plugin for WordPress contains an authorization bypass vulnerability that allows unauthorized modification of post ownership. The vulnerability exists in all versions up to, and including, 1.0.23 due to improper security controls in the AJAX action handler build-app-online-update-vendor-product.

Critical Impact

Unauthenticated attackers can orphan posts by setting their author to 0, while authenticated attackers can claim ownership of any post on the WordPress installation.

Affected Products

• Build App Online WordPress plugin versions up to and including 1.0.23

Discovery Timeline

• 2026-03-21 - CVE-2026-3651 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-3651

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), representing a broken access control flaw in the Build App Online WordPress plugin. The core issue stems from the plugin registering an AJAX action via wp_ajax_nopriv_ without implementing proper security controls, allowing any user—including unauthenticated visitors—to invoke the vulnerable function.

The update_vendor_product() function accepts a user-supplied post ID from the HTTP request and proceeds to call wp_update_post() to modify the post_author field. The function fails to implement three critical security mechanisms: authentication checks to verify user identity, capability verification to confirm authorization for the requested action, and nonce validation to prevent cross-site request forgery attacks.

The impact of this vulnerability manifests in two distinct attack scenarios. Unauthenticated attackers can set the post_author field to 0, effectively orphaning posts from their legitimate authors and potentially disrupting content attribution across the site. Authenticated attackers with even minimal privileges can claim ownership of any post by setting themselves as the author, enabling unauthorized content manipulation and potential privilege escalation within the WordPress content management workflow.

Root Cause

The root cause is the plugin's failure to implement any access control mechanisms in the update_vendor_product() function. By using wp_ajax_nopriv_ hook without corresponding authentication checks, capability verification, or nonce validation, the plugin exposes a critical administrative function to unauthorized access. The function blindly trusts user-supplied input for the post ID parameter and allows arbitrary modification of post ownership.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can craft a malicious HTTP request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to build-app-online-update-vendor-product along with a target post ID. The vulnerable function will process this request without verifying that the requester has any legitimate authorization to modify the specified post.

The vulnerability can be exploited by sending a crafted POST request to the WordPress AJAX handler. The request would include the action parameter identifying the vulnerable endpoint along with parameters specifying the target post ID and the desired author value. Without any authentication or authorization checks, the server processes this request and modifies the post author field accordingly. For detailed code analysis, see the vulnerable code in class-build-app-online-admin.php.

Detection Methods for CVE-2026-3651

Indicators of Compromise

• Unexpected HTTP POST requests to /wp-admin/admin-ajax.php with the action parameter build-app-online-update-vendor-product
• Posts suddenly appearing with post_author set to 0 (orphaned posts)
• Unexplained changes in post authorship across the WordPress database
• Spike in AJAX requests from unauthenticated sessions targeting the vulnerable endpoint

Detection Strategies

• Monitor web server access logs for POST requests to admin-ajax.php containing the build-app-online-update-vendor-product action from unauthenticated sources
• Implement WordPress database auditing to track changes to the post_author field in the wp_posts table
• Deploy a Web Application Firewall (WAF) rule to flag or block requests to the vulnerable AJAX action
• Review WordPress audit logs for unusual patterns of post ownership changes

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX requests, particularly those utilizing wp_ajax_nopriv_ hooks
• Configure alerts for posts with post_author values of 0, which typically indicate unauthorized modification
• Implement real-time monitoring of the wp_posts table for unexpected post_author modifications
• Review authentication patterns in access logs to identify exploitation attempts from unauthenticated sources

How to Mitigate CVE-2026-3651

Immediate Actions Required

• Immediately deactivate the Build App Online plugin until a patched version is available
• Audit the wp_posts table for any posts with unexpected post_author values, especially those set to 0
• Review web server logs for evidence of exploitation attempts targeting the vulnerable AJAX endpoint
• Consider implementing a WAF rule to block requests to the build-app-online-update-vendor-product action

Patch Information

At the time of publication, no official patch has been confirmed. Organizations should monitor the Wordfence Vulnerability Report for updates on patch availability. Until a fix is released, deactivating the plugin is the recommended mitigation approach.

Workarounds

• Deactivate and remove the Build App Online plugin from WordPress installations
• Implement a custom plugin or functions.php code snippet to block the vulnerable AJAX action at the application level
• Configure server-level URL filtering to deny POST requests containing the action parameter build-app-online-update-vendor-product
• Restrict access to admin-ajax.php for unauthenticated users if not required by other site functionality

# Apache .htaccess rule to block the vulnerable action
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php [NC]
RewriteCond %{QUERY_STRING} action=build-app-online-update-vendor-product [NC,OR]
RewriteCond %{REQUEST_BODY} action=build-app-online-update-vendor-product [NC]
RewriteRule .* - [F,L]
</IfModule>