CVE-2026-11882 Builderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public REST Routes
Unauthenticated attackers can poison OAuth tokens via public REST routes, potentially overwriting stored integration access tokens on connected sites.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-11882?
CVE-2026-11882 is a low-severity authentication bypass vulnerability in Unknown Builderall for WordPress, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable overwrite requires the site to already be connected to a paid account.
Weakness: CWE-284
Which versions are affected by CVE-2026-11882?
How do I fix CVE-2026-11882?
No fix has been published for CVE-2026-11882 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-11882 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-11882 exists.
Sources
Also known as GHSA-q7qm-9x83-phwf.