CVE-2026-11882 is an improper access control vulnerability (CWE-284) in the Builderall for WordPress plugin prior to version 3.0.2. The issue arises because the plugin's public OAuth authentication routes fail to bind the state parameter to the user session that initiated the OAuth flow. This flaw enables unauthenticated attackers to finalize the OAuth connection process and overwrite the stored access token for third-party integrations. For the overwrite to be durable, the targeted site must already have an active connection to a paid Builderall account. No CVSS score or known exploits in the wild are currently reported.

An attacker can unauthenticatedly manipulate the OAuth connection process to overwrite stored third-party integration access tokens. This could potentially disrupt integrations relying on these tokens or allow unauthorized access via the overwritten tokens. However, a persistent impact requires the site to be connected to a paid Builderall account, limiting the scope of exploitation. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented, users should monitor for updates from the Builderall plugin vendor and apply any released updates promptly. Until a fix is available, consider restricting access to the OAuth authentication routes or implementing additional access controls if feasible.