What is CVE-2026-11882?

CVE-2026-11882 is a low-severity vulnerability in Builderall For WordPress, classified under Improper Access Control. CVSS score: 3.7/10. Published 2026-08-01.

How severe is CVE-2026-11882?

Low severity. CVSS v3 base score is 3.7 out of 10.

Vulnerability in Builderall For WordPress

CVE-2026-11882

The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable overwrite requires the site to already be connected to a paid account.

EPSS: 0.002 (9.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Unknown Builderall For Wordpress — versions 0

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-11882?: CVE-2026-11882 is a low-severity vulnerability in Builderall For WordPress, classified under Improper Access Control. CVSS score: 3.7/10. Published 2026-08-01.
How severe is CVE-2026-11882?: Low severity. CVSS v3 base score is 3.7 out of 10.