CVE-2017-1002002

Think of “webapp-builder” as a tool that helps you build web pages in WordPress. In this case, the plugin includes an unwanted, vulnerable piece of CMS software; that makes it possible for an attacker to break into your site and cause damage. If someone can reach it, the risk is not just page changes—it can mean taking control of your website.

This matters to you if you use the WordPress plugin “webapp-builder”. The risk is about remote attackers reaching the vulnerable plugin behavior; public exploitation exists, so exposure is more dangerous than a theoretical bug. The findings indicate it is not dependent on a login (no credentials required), so the main gate is whether the vulnerable plugin version is installed and reachable from the internet.

Treat this as urgent because a public exploit is available, meaning attackers can use it without needing special access. The vulnerability is already addressed by a fixed version, so the safest step is to get to the fixed release quickly. Because KEV is not listed here, you don’t have confirmation of mass exploitation—but the public exploit availability makes delay risky.

Confirm exposure

• Log into WordPress Admin.
• Go to Plugins and find webapp-builder.
• Note the installed version.

Determine if you’re affected

• This report describes a vulnerability in webapp-builder v2.0.
• If your installed version matches the vulnerable version mentioned, you should treat the site as exposed.

Upgrade / fix

• The findings state: fixed in 2.0.
• Apply the vendor update that corresponds to the fixed release.
• After updating, verify:
  • The site still loads normally.
  • WordPress admin pages work.
  • No new errors appear in plugin/theme functionality.

If you can’t patch immediately (workaround)

• Temporarily reduce exposure until the update is applied:
  • Restrict internet access to your WordPress site (for example, allow only office IPs via firewall/VPN).
  • If you run behind a reverse proxy or WAF, apply the tightest available rules for WordPress and the specific plugin routes.

What to monitor after the change

• Check for unexpected admin users, new plugin/theme installations, and modified content.
• Review web server and WordPress logs for suspicious requests around the plugin’s endpoints.

CISA/KEV timeline

• This CVE is not listed in CISA KEV (so there is no KEV-based due date from the provided findings).

Severity and exploitation

• Public exploitation exists (the findings mention a public exploit with 2 known items).
• CISA KEV is not listed for this CVE in the provided findings.
• Press attention was reported as unknown (no reliable exploitation confirmation from that source).

Weakness / mechanism

• The weakness is categorized as CWE-434.
• The plugin description indicates it includes unlicensed vulnerable CMS software; this typically means an attacker may reach vulnerable code paths present in that bundled component.

Attackability signals from the report

• The reported characteristics include network-reachable attack and no credentials required (consistent with PR:N in the provided CVSS vector).
• The potential impact spans confidentiality, integrity, and availability (consistent with the high severity rating shown in the prompt).

Fix

• A fixed version is indicated: webapp-builder → fixed in 2.0.

EPSS note

• The provided EPSS is a prediction; no KEV/news exploitation confirmation is included in the findings, so the public urgency is driven mainly by the presence of public exploits and the availability of a fix.