CVE-2026-11882 describes an improper access control vulnerability (CWE-284) in the Builderall for WordPress plugin prior to version 3.0.2. The plugin fails to bind the state value of its public OAuth authentication routes to the initiating user session. This allows unauthenticated attackers to complete the OAuth connection flow and overwrite the stored third-party integration access token. A persistent overwrite requires the target site to already be connected to a paid Builderall account. The vulnerability has a CVSS 3.1 base score of 3.7 (low), with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts integrity only.

The vulnerability allows an unauthenticated attacker to overwrite the third-party integration access token used by the Builderall plugin on a WordPress site. This could lead to limited integrity impact by replacing the token with an attacker-controlled value. There is no impact on confidentiality or availability. The attack requires the site to be connected to a paid Builderall account and has high attack complexity, reducing the likelihood of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is available at this time. Users should monitor vendor communications for updates and apply any released updates promptly. Until a fix is available, restricting access to the OAuth authentication routes or disabling the Builderall plugin if not in use may reduce exposure.