The Build App Online plugin for WordPress registers an AJAX endpoint named 'build-app-online-update-vendor-product' that accepts a post ID from the requester and invokes wp_update_post() to change the post_author field. Because the endpoint is registered with wp_ajax_nopriv and lacks a capability check, nonce verification, or any authentication step, an attacker can send the request without logging in. This allows an unauthenticated user to set the author of any post to themselves or to zero, effectively orphaning the post. The core weakness is a missing authorization check (CWE‑862), resulting in potential defacement, content hijacking, and denial of rightful ownership.

The vulnerable code resides in the Build App Online plugin developed by hakeemnala. All releases up to and including version 1.0.23 contain the insecure AJAX action. Any WordPress installation that has this plugin installed and is running a version ≤1.0.23 is affected. The issue affects the administrative area of the site, but the attack vector operates through a publicly accessible AJAX route.

The severity score of 5.3 indicates moderate risk. The absence of authentication checks makes the vulnerability trivial to exploit from any network that can reach the WordPress site. Because the EPSS score is not available, the likelihood of exploitation is unclear, but the straightforward attack path and lack of safeguards suggest a high probability of real‑world abuse. The vulnerability is not listed in the CISA KEV catalog; however, sites running the affected plugin remain at risk of content takeover or defacement until the issue is remediated.