Build App Online WordPress Plugin Missing Authorization Vulnerability in AJAX Action

A vulnerability exists in the Build App Online plugin for WordPress, affecting all versions up to and including 1.0.23. The issue arises from the plugin registering the 'build-app-online-update-vendor-product' AJAX action without proper authentication, capability verification, or nonce validation. This allows unauthorized users to modify the post_author field of arbitrary posts. Unauthenticated attackers can set the post_author to 0, orphaning posts from their legitimate authors, while authenticated attackers can claim ownership of any post by assigning themselves as the author.

Impact

Exploitation of this vulnerability allows for unauthorized modification of post authorship, enabling attackers to orphan posts or falsely claim ownership of posts.