CVE-2026-7638: CWE-639 Authorization Bypass Through User-Controlled Key in appcheap App Builder – Create Native Android & iOS Apps On The Flight
The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 5.6.0. This is due to missing authorization validation in the `upload_avatar()` function, which accepts an attacker-controlled `user_id` parameter from the POST request body and uses it to update user meta without verifying that the authenticated requester owns or has permission to modify the target account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the profile avatar of any arbitrary user on the site, including administrators, by supplying a target `user_id` in the request body to the `/wp-json/app-builder/v1/upload-avatar` endpoint.
AI Analysis
Technical Summary
CVE-2026-7638 is an insecure direct object reference vulnerability (CWE-639) in the App Builder – Create Native Android & iOS Apps On The Flight WordPress plugin. The vulnerability arises because the upload_avatar() function does not validate that the authenticated user has permission to modify the user account identified by the user_id parameter in the POST request body. This allows an authenticated attacker with minimal privileges to update the avatar of arbitrary users, including administrators, by sending a crafted request to the /wp-json/app-builder/v1/upload-avatar REST API endpoint. The issue affects all plugin versions up to and including 5.6.0.
Potential Impact
An attacker with Subscriber-level or higher access can overwrite the profile avatar of any user on the WordPress site, including administrators. While this does not directly disclose sensitive information or allow privilege escalation, it constitutes an integrity violation and could be leveraged for social engineering or further attacks that rely on user profile manipulation.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable REST API endpoint to trusted users only or disable the plugin if feasible. Monitor for updates from the vendor regarding an official patch or temporary mitigation.
CVE-2026-7638: CWE-639 Authorization Bypass Through User-Controlled Key in appcheap App Builder – Create Native Android & iOS Apps On The Flight
Description
The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 5.6.0. This is due to missing authorization validation in the `upload_avatar()` function, which accepts an attacker-controlled `user_id` parameter from the POST request body and uses it to update user meta without verifying that the authenticated requester owns or has permission to modify the target account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the profile avatar of any arbitrary user on the site, including administrators, by supplying a target `user_id` in the request body to the `/wp-json/app-builder/v1/upload-avatar` endpoint.
CVSS v3.1
Score 5.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-7638 is an insecure direct object reference vulnerability (CWE-639) in the App Builder – Create Native Android & iOS Apps On The Flight WordPress plugin. The vulnerability arises because the upload_avatar() function does not validate that the authenticated user has permission to modify the user account identified by the user_id parameter in the POST request body. This allows an authenticated attacker with minimal privileges to update the avatar of arbitrary users, including administrators, by sending a crafted request to the /wp-json/app-builder/v1/upload-avatar REST API endpoint. The issue affects all plugin versions up to and including 5.6.0.
Potential Impact
An attacker with Subscriber-level or higher access can overwrite the profile avatar of any user on the WordPress site, including administrators. While this does not directly disclose sensitive information or allow privilege escalation, it constitutes an integrity violation and could be leveraged for social engineering or further attacks that rely on user profile manipulation.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable REST API endpoint to trusted users only or disable the plugin if feasible. Monitor for updates from the vendor regarding an official patch or temporary mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-05-01T15:32:16.078Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69f57840cbff5d861067b4e9
Added to database: 5/2/2026, 4:06:24 AM
Last enriched: 5/10/2026, 2:13:14 AM
Last updated: 6/16/2026, 2:57:36 AM
Views: 77
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.