Missing authorization in hakeemnala Build App Online
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The Build App Online plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.23. This is due to the plugin registering the 'build-app-online-update-vendor-product' AJAX action via wp_ajax_nopriv_ without proper authentication checks, capability verification, or nonce validation in the update_vendor_product() function. The function accepts a user-supplied post ID from the request and calls wp_update_post() to modify the post_author field without validating whether the user has permission to modify the specified post. This makes it possible for unauthenticated attackers to modify the post_author of arbitrary posts to 0 (orphaning posts from their legitimate authors), or for authenticated attackers to claim ownership of any post by setting themselves as the author.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| hakeemnala | Build App Online | up to 1.0.23 | — | No fix listed | CNA |
- Build App Online Vendorhakeemnala Affected up to 1.0.23 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:buildapp:build_app_online:*:*:*:*:*:*:*:* | — | — | hakeemnala |
- cpe:2.3:a:buildapp:build_app_online:*:*:*:*:*:*:*:* Versions — — ·hakeemnala
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-3651
- 2026-10-03 Alias added: GHSA-xcmm-m27h-87pr
References
Other 7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/51564b26-0d7c-4499-9f5a-84f76c5a5e8a?source=cve
- https://plugins.trac.wordpress.org/browser/build-app-online/trunk/admin/class-build-app-online-admin.php#L565
- https://plugins.trac.wordpress.org/browser/build-app-online/tags/1.0.23/admin/class-build-app-online-admin.php#L565
- https://plugins.trac.wordpress.org/browser/build-app-online/trunk/admin/class-build-app-online-admin.php#L556
- https://plugins.trac.wordpress.org/browser/build-app-online/tags/1.0.23/admin/class-build-app-online-admin.php#L556
- https://plugins.trac.wordpress.org/browser/build-app-online/trunk/includes/class-build-app-online.php#L233
- https://plugins.trac.wordpress.org/browser/build-app-online/tags/1.0.23/includes/class-build-app-online.php#L233
More hakeemnala vulnerabilities
- TI-2025-23642 WordPress Build App Online Plugin <= 1.0.23 - Local File Inclusion vulnerability CVSS 3.1CRITICAL 9.8
- TI-2024-33135 WordPress Build App Online plugin <= 1.0.23 - Local File Inclusion vulnerability CVSS 3.1CRITICAL 9.8
- TI-2023-28130 WordPress Build App Online plugin <= 1.0.19 - Unauthenticated Account Takeover vulnerability CVSS 3.1CRITICAL 9.8
- TI-2023-06644 Build App Online <= 1.0.22 - Account Takeover via Weak Password Reset Mechanism CVSS 3.1CRITICAL 9.8
- TI-2023-28131 WordPress Build App Online plugin <= 1.0.19 - Authenticated Privilege Escalation vulnerability CVSS 3.1HIGH 8.8
- TI-2024-35949 WordPress Build App Online plugin <= 1.0.23 - Cross Site Request Forgery (CSRF) vulnerability CVSS 3.1HIGH 8.8
Sources
- CVE-2026-3651 · CVE Program
- CVE-2026-3651 · NVD
- FIRST EPSS
- GHSA-xcmm-m27h-87pr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences