Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · build-app-online
Build App Online
9 known vulnerabilities on record. Add your version above to see which ones affect you.
Mar 21, 2026Build App Online: Unauthorized accessCVE-2026-3651 · affects up to 1.0.23 · reported by WordfenceMedium 5.3
The Build App Online plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.23. This is due to the plugin registering the 'build-app-online-update-vendor-product' AJAX action via wp_ajax_nopriv_ without proper authentication checks, capability verification, or nonce validation in the update_vendor_product() function. The function accepts a user-supplied post ID from the request and calls wp_update_post() to modify the post_author field without validating whether the user has permission to modify the specified post. This makes it possible for unauthenticated attackers to modify the post_author of arbitrary posts to 0 (orphaning posts from their legitimate authors), or for authenticated attackers to claim ownership of any post by setting themselves as the author.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 2025Build App Online: Cross-Site Request Forgery (CSRF)CVE-2025-53249 · affects up to 1.0.23 · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in hakeemnala Build App Online build-app-online allows Cross Site Request Forgery.This issue affects Build App Online: from n/a through <= 1.0.23.
Apr 11, 2025Build App Online: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32577 · affects up to 1.0.23 · reported by PatchstackCritical 9.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hakeemnala Build App Online build-app-online allows PHP Local File Inclusion.This issue affects Build App Online: from n/a through <= 1.0.23.
Jan 7, 2025Build App Online: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-49649 · affects up to 1.0.23 · reported by PatchstackCritical 9.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hakeemnala Build App Online build-app-online allows PHP Local File Inclusion.This issue affects Build App Online: from n/a through <= 1.0.23.
Dec 2, 2024Build App Online: Cross-Site Request Forgery (CSRF)CVE-2024-53751 · affects up to 1.0.23 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in hakeemnala Build App Online build-app-online allows Cross Site Request Forgery.This issue affects Build App Online: from n/a through <= 1.0.23.
Jun 11, 2024Build App Online: Account takeoverCVE-2023-7264 · affects up to 1.0.22 · reported by WordfenceHigh 8.1
The Build App Online plugin for WordPress is vulnerable to account takeover due to a weak password reset mechanism in all versions up to, and including, 1.0.22. This makes it possible for unauthenticated attackers to reset the password of arbitrary users by guessing an 4-digit numeric reset code.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 17, 2024Build App Online: Improper Privilege ManagementCVE-2023-51479 · affects up to 1.0.19 · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in Abdul Hakeem Build App Online allows Privilege Escalation.This issue affects Build App Online: from n/a through 1.0.19.
Apr 25, 2024Build App Online: Improper AuthenticationCVE-2023-51478 · affects up to 1.0.19 · reported by PatchstackCritical 9.8
Improper Authentication vulnerability in Abdul Hakeem Build App Online allows Privilege Escalation.This issue affects Build App Online: from n/a through 1.0.19.
Jan 2, 2023Build App Online: Does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-3241 · fixed in 1.0.19 · reported by WPScanCritical 9.8
The Build App Online WordPress plugin before 1.0.19 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.