Build App Online

Information

Software Type	Plugin
Software Slug	build-app-online (view on wordpress.org)
Software Status	Removed
Software Author	hakeemnala
Software Website	wordpress.org
Software Downloads	16,307
Software Active Installs	500
Software Record Last Updated	March 15, 2026

9 Vulnerabilities

Submit a Vulnerability

Build App Online <= 1.0.23 - Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-product' AJAX Action

5.3

CVE-2026-3651

Mar 20, 2026

Researchers: Ronnachai Sretawat Na Ayutaya (Simonhaskelly), Ronnachai Chaipha (rxnr)

Build App Online <= 1.0.23 - Cross-Site Request Forgery

4.3

CVE-2025-53249

Aug 14, 2025

Researcher: theviper17y

Build App Online <= 1.0.23 - Unauthenticated Local File Inclusion

9.8

CVE-2025-32577

Apr 9, 2025

Researcher: LVT-tholv2k

Build App Online <= 1.0.23 - Unauthenticated Local File Inclusion

8.1

CVE-2024-49649

Jan 6, 2025

Researcher: Dimas Maulana

Build App Online <= 1.0.22 - Cross-Site Request Forgery

4.3

CVE-2024-53751

Nov 28, 2024

Researcher: ardias

Build App Online <= 1.0.21 - Authentication Bypass via Header

9.8

CVE-2023-51478

Dec 27, 2023

Researchers: Rafie Muhammad, István Márton

Build App Online <= 1.0.20 - Missing Authorization Authenticated(Subscriber+) Arbitrary Options Update

8.8

CVE-2023-51479

Dec 27, 2023

Researcher: Rafie Muhammad

Build App Online <= 1.0.22 - Account Takeover via Weak Password Reset Mechanism

8.1

CVE-2023-7264

Dec 27, 2023

Researcher: Ram

Build App Online <= 1.0.18 - Unauthenticated SQL Injection

9.8

CVE-2022-3241

Dec 6, 2022

Researchers: Francesco Marano, Donato Di Pasquale

Title	Status	CVE ID	CVSS	Researchers	Date
Build App Online <= 1.0.23 - Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-product' AJAX Action	Unpatched	CVE-2026-3651	5.3	Ronnachai Sretawat Na Ayutaya (Simonhaskelly), Ronnachai Chaipha (rxnr)	March 20, 2026
Build App Online <= 1.0.23 - Cross-Site Request Forgery	Unpatched	CVE-2025-53249	4.3	theviper17y	August 14, 2025
Build App Online <= 1.0.23 - Unauthenticated Local File Inclusion	Unpatched	CVE-2025-32577	9.8	LVT-tholv2k	April 9, 2025
Build App Online <= 1.0.23 - Unauthenticated Local File Inclusion	Unpatched	CVE-2024-49649	8.1	Dimas Maulana	January 6, 2025
Build App Online <= 1.0.22 - Cross-Site Request Forgery	Unpatched	CVE-2024-53751	4.3	ardias	November 28, 2024
Build App Online <= 1.0.21 - Authentication Bypass via Header	Patched	CVE-2023-51478	9.8	Rafie Muhammad, István Márton	December 27, 2023
Build App Online <= 1.0.20 - Missing Authorization Authenticated(Subscriber+) Arbitrary Options Update	Patched	CVE-2023-51479	8.8	Rafie Muhammad	December 27, 2023
Build App Online <= 1.0.22 - Account Takeover via Weak Password Reset Mechanism	Patched	CVE-2023-7264	8.1	Ram	December 27, 2023
Build App Online <= 1.0.18 - Unauthenticated SQL Injection	Patched	CVE-2022-3241	9.8	Francesco Marano, Donato Di Pasquale	December 6, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation