This vulnerability is a missing authorization flaw that allows an attacker to bypass the normal access controls of the App Builder plugin. The flaw stems from incorrectly configured security levels, enabling an unauthenticated or improperly privileged user to read or modify protected content, settings, or other resources. The weakness is identified as CWE‑862, indicating that the application does not correctly enforce authorization checks.

The affected product is the WordPress App Builder plugin developed by App Cheap. All releases up to and including version 5.5.6 are vulnerable. No earlier versions are listed as fixed, so any site running these builds should be considered at risk until a newer release is available.

The CVSS score of 5.3 indicates a medium severity level, while the EPSS score of less than 1 % signals a low probability of exploitation in the wild. The flaw is not recorded in the CISA KEV catalog, reducing the likelihood of widespread, targeted attacks. The likely attack vector is remote, via crafted web requests to the WordPress site that hosts the plugin. An attacker with the ability to send such requests can exploit the missing checks to gain unauthorized access.