Executive brief
The Builderall for WordPress plugin, used for website building and marketing integration, contains a security flaw in how it handles third-party account connections. An attacker can exploit this to overwrite the site's connection to Builderall services with their own credentials. This could disrupt the site's integration with paid marketing tools and potentially redirect data or services to an account controlled by the attacker.
Technical details
The Builderall for WordPress plugin (builderall-cheetah-for-wp) fails to bind the 'state' parameter in its public OAuth authentication REST routes to the initiating user's session. This lack of CSRF-like protection in the OAuth flow allows an unauthenticated attacker to complete the connection handshake using their own credentials. If the target site is already connected to a paid Builderall account, the attacker can overwrite the stored third-party integration access token. This is classified as a broken access control issue (CWE-284). The vulnerability is addressed in version 3.0.2.
Affected products
- Builderall Builderall for WordPress (Cheetah) < 3.0.2
Timeline
- 2026-07-20: disclosed: Initial public disclosure by WPScan
- 2026-07-20: patched: Fix released in version 3.0.2
- 2026-08-01: advisory: CVE published to NVD