The App Builder plugin for WordPress has a privilege escalation flaw that allows anyone to register a user with vendor rights without authentication. By sending a 'role' parameter in the register REST endpoint, an attacker can create a user assigned the wcfm_vendor role, bypassing the WCFM Marketplace vendor approval process. This grants immediate vendor-level capabilities, including product management, order access, and store control, potentially exposing sensitive data and altering store configuration.

The vulnerability affects the App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress, all releases up to and including version 5.5.10 installed on sites that also run the WCFM Marketplace plugin. No other products or versions are known to be impacted.

The flaw carries a CVSS score of 6.5, indicating moderate severity. Although EPSS data is unavailable and the issue is not in CISA’s KEV catalog, the attack vector is unauthenticated and relies on a standard REST API call, making exploitation straightforward for anyone with network access to the site. Organizations that host e‑commerce shops with WCFM Marketplace should treat this as an urgent risk until the plugin is updated or alternative controls are applied.