CVE-2024-49649

The vulnerability results from improper control of the file name passed to include/require instructions in PHP code (CWE-98, CWE-829). An attacker can manipulate the input parameter in such a way as to force the application to include and execute a file located on the server, for example log files, configuration files, or other resources available in the file system. The attack does not require authentication or user interaction and can be carried out remotely over the network.

An attacker can read sensitive files from the server (e.g., configuration data, passwords), and under favorable conditions, lead to the execution of malicious code, which may result in complete server takeover.

The Build App Online plugin should be updated to a version higher than 1.0.23. Details regarding available patches can be found in the vendor's references and in the Patchstack database.

The WordPress Build App Online plugin by hakeemnaal in versions from initial availability through 1.0.23 inclusive.