CVE-2023-51478CWE-287

WordPress Build App Online plugin <= 1.0.19 - Unauthenticated Account Takeover vulnerability

Critical · published April 25, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
52.5
In the wild
Unconfirmed
What it is

🔥 An improper authentication hole in Abdul Hakeem Build App Online could let a user escalate their privileges and become the top dog in the system! Think of this like a restaurant where a patron cleverly persuades the staff to hand over the keys to the VIP lounge, allowing them to serve themselves the best dishes without any authorization checks. Without proper safeguards, anyone can waltz in and access areas they shouldn’t! An attacker exploiting this vulnerability could gain unauthorized access, elevating their privileges and potentially wreaking havoc on the system. They could manipulate, delete, or even create data that could compromise the entire environment, leading to absolutely devastating consequences for all users involved!

Put simply

Think of this like a restaurant where a patron cleverly persuades the staff to hand over the keys to the VIP lounge, allowing them to serve themselves the best dishes without any authorization checks. Without proper safeguards, anyone can waltz in and access areas they shouldn’t! This vulnerability arises from improper authentication checks in the Build App Online application, affecting versions up to 1.0.19. An attacker can exploit it to gain higher privileges, bypassing normal access controls.

What to do

An attacker exploiting this vulnerability could gain unauthorized access, elevating their privileges and potentially wreaking havoc on the system. They could manipulate, delete, or even create data that could compromise the entire environment, leading to absolutely devastating consequences for all users involved! Patch to version 1.0.20 immediately to close this security gap. Additionally, review authentication mechanisms to ensure strict access controls are enforced, and regularly audit user permissions to prevent unauthorized escalation. You've got this! Following these steps will help you lock down your application and keep it safe from prying eyes! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00697 · 52.5th percentile
Weakness
CWE-287 · Improper Authentication
Published
2024-04-25T07:56Z
EPSS history
Timeline
  • 25 APR 07:56Z
    WordPress Build App Online plugin <= 1.0.19 - Unauthenticated Account Takeover vulnerability
    cvelistv5