CVE-2026-94294— App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php
Quick assessment
Affected
Unknown App Builder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在版本 5.7.1 之前的 App Builder WordPress 插件存在安全漏洞：该插件在将攻击者提供的数据写入其某个选项（option）时，未要求任何身份验证或授权；随后，在另一次无需验证的请求中，插件会将访问者的浏览器重定向到一个由该已存储数据构造的 URI。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-94294
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php
Source: CVE Program / CVE List V5
Vulnerability Description
The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | App Builder | 3.8.4 ~ 5.7.1 | - |
|
II. Public POCs for CVE-2026-94294
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-94294
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-10-19 · 20 CVEs total
| CVE-2026-74921 | 6.8 MEDIUM | Document Gallery 4.0 - 5.1.1 - Contributor+ Stored XSS via Gallery Shortcode Attributes |
| CVE-2026-94272 | 5.3 MEDIUM | Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple A |
| CVE-2026-94230 | 5.3 MEDIUM | TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbit |
| CVE-2026-94229 | 5.3 MEDIUM | TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via |
| CVE-2026-94228 | 5.3 MEDIUM | TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite v |
| CVE-2026-86791 | 5.3 MEDIUM | iPOSpays Payment Gateway for WooCommerce < 1.4.7 - Unauthenticated Payment Confirmation Fo |
| CVE-2026-74922 | 5.3 MEDIUM | Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber |
| CVE-2026-94231 | 5.3 MEDIUM | TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creati |
| CVE-2026-103311 | 5.3 MEDIUM | Coinbase Commerce Payment Gateway for WooCommerce <= 1.4.1 - Unauthenticated Webhook Signa |
| CVE-2026-106010 | 5.3 MEDIUM | BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation Forgery |
| CVE-2026-91831 | 3.8 LOW | Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting |
| CVE-2026-110034 | 3.7 LOW | Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code |
| CVE-2026-94273 | Snap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_com | |
| CVE-2026-89286 | FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File | |
| CVE-2026-106014 | Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment C | |
| CVE-2026-91047 | ElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass | |
| CVE-2026-106933 | Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload | |
| CVE-2026-91046 | ElementsReady Addons for Elementor <= 6.7.2 - Subscriber+ Plugin Settings Overwrite via Mi | |
| CVE-2026-106028 | ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation |
IV. Related Vulnerabilities
Same product: App Builder
-
CVE-2026-10706
Exposure of Sensitive Information to an Unauthorized attacke -
CVE-2026-10708
Insufficiently Protected Credentials -
CVE-2025-49989
WordPress App Builder plugin <= 5.5.6 - Broken Access Contro -
CVE-2024-32565
WordPress App Builder plugin <= 3.8.8 - Cross Site Scripting -
CVE-2024-31282
WordPress App Builder plugin <= 3.8.7 - Open Redirection vul
Same vendor: Unknown
-
CVE-2026-94231
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticat -
CVE-2026-94272
Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Orde -
CVE-2026-94230
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticat -
CVE-2026-94229
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticat -
CVE-2026-94228
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticat
V. Comments for CVE-2026-94294
No comments yet