App Builder – Create Native Android & iOS Apps On The Flight

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   App Builder – Create Native Android & iOS Apps On The Flight

Information

Software Type Plugin
Software Slug app-builder (view on wordpress.org)
Software Status Active
Software Author appcheap
Software Website appcheap.io
Software Downloads 66,765
Software Active Installs 600
Software Record Last Updated July 18, 2026

7 Vulnerabilities

Submit a Vulnerability
App Builder <= 5.5.10 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameter
5.3
CVE-2026-7638
May 1, 2026
Researcher: Ren Voza
App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter
6.5
CVE-2026-2375
Mar 20, 2026
Researcher: Gibran Abdillah
App Builder <= 5.5.7 - Missing Authorization
5.3
CVE-2025-49989
Jun 19, 2025
Researcher: Hiro
App Builder – Create Native Android & iOS Apps On The Flight <= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTP
8.1
CVE-2024-9302
Oct 24, 2024
Researcher: wesley (wcraft)
App Builder – Create Native Android & iOS Apps On The Flight <= 4.3.3 - Unauthenticated Limited SQL Injection via app-builder-search
5.6
CVE-2024-7651
Aug 20, 2024
Researcher: vgo0
App Builder <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-32565
Apr 16, 2024
Researcher: LVT-tholv2k
App Builder <= 3.8.7 - Open Redirection
5.4
CVE-2024-31282
Apr 5, 2024
Researcher: beluga
Title Status CVE ID CVSS Researchers Date
App Builder <= 5.5.10 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameter Unpatched CVE-2026-7638 5.3 Ren Voza May 1, 2026
App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter Unpatched CVE-2026-2375 6.5 Gibran Abdillah March 20, 2026
App Builder <= 5.5.7 - Missing Authorization Patched CVE-2025-49989 5.3 Hiro June 19, 2025
App Builder – Create Native Android & iOS Apps On The Flight <= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTP Patched CVE-2024-9302 8.1 wesley (wcraft) October 24, 2024
App Builder – Create Native Android & iOS Apps On The Flight <= 4.3.3 - Unauthenticated Limited SQL Injection via app-builder-search Patched CVE-2024-7651 5.6 vgo0 August 20, 2024
App Builder <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Patched CVE-2024-32565 6.4 LVT-tholv2k April 16, 2024
App Builder <= 3.8.7 - Open Redirection Patched CVE-2024-31282 5.4 beluga April 5, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation