WordPress plugin
Build App Online security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical3
- High3
- Medium3
- Low0
All Build App Online vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-product' AJAX Action ≤1.0.23No patch available | CVE-2026-3651 | |
| Medium4.3 | Cross-Site Request Forgery ≤1.0.23No patch available | CVE-2025-53249 | |
| Critical9.8 | Unauthenticated Local File Inclusion ≤1.0.23No patch available | CVE-2025-32577 | |
| High8.1 | Unauthenticated Local File Inclusion ≤1.0.23No patch available | CVE-2024-49649 | |
| Medium4.3 | Cross-Site Request Forgery ≤1.0.22No patch available | CVE-2024-53751 | |
| Critical9.8 | Authentication Bypass via Header ≤1.0.21Update to 1.0.22 | CVE-2023-51478 | |
| High8.8 | Missing Authorization Authenticated(Subscriber+) Arbitrary Options Update ≤1.0.20Update to 1.0.21 | CVE-2023-51479 | |
| High8.1 | Account Takeover via Weak Password Reset Mechanism ≤1.0.22Update to 1.0.23 | CVE-2023-7264 | |
| Critical9.8 | Unauthenticated SQL Injection ≤1.0.18Update to 1.0.19 | CVE-2022-3241 |
- Medium5.3Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-product' AJAX Action
≤1.0.23No patch available
- Medium4.3Cross-Site Request Forgery
≤1.0.23No patch available
- Critical9.8Unauthenticated Local File Inclusion
≤1.0.23No patch available
- High8.1Unauthenticated Local File Inclusion
≤1.0.23No patch available
- Medium4.3Cross-Site Request Forgery
≤1.0.22No patch available
- Critical9.8Authentication Bypass via Header
≤1.0.21Update to 1.0.22
- High8.8Missing Authorization Authenticated(Subscriber+) Arbitrary Options Update
≤1.0.20Update to 1.0.21
- High8.1Account Takeover via Weak Password Reset Mechanism
≤1.0.22Update to 1.0.23
- Critical9.8Unauthenticated SQL Injection
≤1.0.18Update to 1.0.19
Build App Online: common questions
Does Build App Online have known vulnerabilities?
Yes. VulnCrest Radar lists 9 known vulnerabilities in Build App Online: 3 critical, 3 high, 3 medium. At least one is not fixed in the latest version.
How do I check which version of Build App Online I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Build App Online vulnerability?
CVE-2026-3651, published Mar 20, 2026: Build App Online <= 1.0.23 - Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-product' AJAX Action. Severity: Medium (CVSS 5.3).
Is any Build App Online vulnerability listed in CISA KEV?
No. None of the known Build App Online vulnerabilities is currently listed in the CISA KEV catalog.