The Builderall for WordPress plugin contains a flaw where the state value used in its public OAuth authentication routes is not bound to the initiating user session. This is an access control issue (CWE‑284) where the state value is not associated with the specific user session. An attacker can exploit this by completing the OAuth handshake without authentication, thereby overwriting the stored third‑party integration access token. This unauthorized token replacement can jeopardize the integrity of the site’s external integrations. The impact is limited to the ability to modify the token; potential further exploitation, such as unauthorized access to the external service, is inferred but not confirmed by the description.

Any WordPress site running Builderall for WordPress plugin version earlier than 3.0.2 is affected. The exploit requires the site to have an existing paid account integration, as a lasting overwrite depends on a pre‑existing connection.

Attackers need only send HTTP requests to the public REST endpoints; no credentials are required. The CVSS score of 3.7 indicates a low severity. The EPSS score is less than 1% and the vulnerability is not listed in CISA KEV. The likely attack vector is simple unauthenticated HTTP calls to the plugin’s exposed routes. The requirement that the site already have a paid integration connection limits the pool of vulnerable targets, but once reached, the exploitation is straightforward.