CVE-2026-7638: WordPress App Builder IDOR Vulnerability

CVE-2026-7638 Overview

CVE-2026-7638 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress. The flaw exists in all versions up to and including 5.6.0. The upload_avatar() function fails to validate authorization on a user-supplied user_id parameter, allowing authenticated users with Subscriber-level access or higher to overwrite any user's profile avatar. Targets include administrator accounts. The vulnerability is classified under [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact

Authenticated attackers with minimal privileges can replace the avatar of any WordPress user, including administrators, by manipulating the user_id field in requests to the /wp-json/app-builder/v1/upload-avatar endpoint.

Affected Products

• App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress
• All versions up to and including 5.6.0
• WordPress sites exposing the /wp-json/app-builder/v1/upload-avatar REST endpoint

Discovery Timeline

• 2026-05-02 - CVE-2026-7638 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7638

Vulnerability Analysis

The vulnerability resides in the plugin's avatar upload handler. When an authenticated user submits a POST request to /wp-json/app-builder/v1/upload-avatar, the upload_avatar() function reads a user_id parameter from the request body. The function then writes the uploaded avatar to user meta for that account without confirming the requester owns the account or possesses the edit_user capability.

Because the endpoint accepts any logged-in user, attackers only need a Subscriber-level account. They can iterate through user_id values to target privileged accounts. The result is unauthorized modification of integrity-relevant profile data across the site.

While defacement of administrator avatars is the direct outcome, the attack surface enables phishing scenarios where an attacker replaces avatars with misleading imagery to mislead site visitors or trick administrators into clicking malicious content.

Root Cause

The root cause is missing authorization validation in the permission callback for the avatar upload route. The Permission trait used by the plugin verifies that the caller is authenticated but does not verify ownership of the user_id referenced in the request body. The handler trusts client-supplied identifiers and passes them directly to user meta update routines.

Attack Vector

Exploitation requires a valid authenticated session at Subscriber level or higher. The attacker sends a crafted POST request to /wp-json/app-builder/v1/upload-avatar containing a user_id parameter set to the target account ID along with an avatar file. The server processes the upload and updates the target user's avatar meta. No user interaction from the victim is required. Refer to the Wordfence Vulnerability Report and the plugin source code on WordPress Trac for technical references.

Detection Methods for CVE-2026-7638

Indicators of Compromise

• POST requests to /wp-json/app-builder/v1/upload-avatar containing a user_id parameter that does not match the authenticated session user.
• Unexpected changes to administrator or editor avatars without corresponding profile activity from those accounts.
• Multiple avatar upload requests from a single low-privileged account targeting different user_id values in sequence.

Detection Strategies

• Inspect web server and WordPress access logs for requests to the App Builder REST namespace /wp-json/app-builder/v1/.
• Correlate the authenticated user ID from session cookies with the user_id POST body parameter and alert on mismatches.
• Monitor the wp_usermeta table for changes to avatar-related meta keys not initiated by the owning user.

Monitoring Recommendations

• Enable verbose logging on REST API endpoints exposed by third-party plugins.
• Track the volume of avatar upload requests per session and flag accounts that exceed normal user behavior.
• Audit administrator profile metadata on a scheduled basis to identify unauthorized modifications.

How to Mitigate CVE-2026-7638

Immediate Actions Required

• Update the App Builder plugin to a version newer than 5.6.0 once the vendor releases a patched build.
• Audit existing user accounts and remove unused Subscriber-level accounts that could be leveraged for exploitation.
• Review administrator and editor avatars for unauthorized changes and restore originals if tampering is detected.

Patch Information

At the time of publication, the vulnerability affects all versions up to and including 5.6.0. Site operators should monitor the WordPress plugin repository for App Builder for an updated release that adds an ownership check to the upload_avatar() permission callback.

Workarounds

• Disable or deactivate the App Builder plugin until a fixed version is available if the mobile app integration is not in active use.
• Restrict access to the /wp-json/app-builder/v1/upload-avatar endpoint at the web application firewall (WAF) layer for non-administrator IP ranges.
• Disable open user registration to limit the pool of potential attackers who could obtain Subscriber-level access.

# Example WAF rule blocking non-admin access to the vulnerable endpoint
# (adjust according to your WAF syntax)
location ~ ^/wp-json/app-builder/v1/upload-avatar {
    allow 10.0.0.0/8;        # internal admin network
    deny all;
    return 403;
}