The App Builder WordPress plugin before version 5.7.1 lacks authentication or authorization checks before allowing a user to write arbitrary data to a plugin option. A separate request then uses that stored data to build a redirect URL, causing the visitor’s browser to navigate to an attacker‑controlled site. The vulnerability permits an unauthenticated actor to change plugin configuration and facilitate phishing or defacement attacks, compromising confidentiality and availability of the site.

WordPress sites running the App Builder plugin version 5.7.0 or earlier are affected. The vendor is listed as Unknown:App Builder; no further product details are available.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is through the public network, requiring no special credentials. An attacker can complete the write and trigger the redirect in a single session, potentially redirecting users to malicious pages.