CVE-2026-11882
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token.
Risk Assessment
An attacker can take over the third-party integration, potentially leading to unauthorized access to data or services connected to the site.
Recommendation
Update the Builderall for WordPress plugin to version 3.0.2 or later, which includes OAuth state binding.
Other vulnerabilities in Builderall for WordPress
See all- CVE-2026-15820Medium
The Builderall for WordPress plugin is vulnerable to Stored Cross-Site Scripting via the Photo Module 'attributes' setting in all versions up to and including 3.0.2 due to insufficient input sanitization and output escaping.
- CVE-2026-15796Medium
The Builderall for WordPress plugin is vulnerable to Stored Cross-Site Scripting via the 'bg_video_service_url' setting in all versions up to and including 3.0.2 due to insufficient input sanitization and output escaping.
Original NVD description (English source)
The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable overwrite requires the site to already be connected to a paid account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS