Authentication Bypass Vulnerability in Build App Online WordPress Plugin

CVE-2024-4186

Summary

The Build App Online plugin for WordPress is vulnerable to an authentication bypass that impacts versions up to and including 3.0.5. This vulnerability arises from a missing condition to check for a non-empty default value in the 'eb_user_email_verification_key', which allows unauthenticated attackers to gain access as any existing user, including administrators, providing they know the user ID. This exploit can be executed only when the 'Email Verification' setting is enabled. Website owners using this plugin should ensure they have implemented necessary security measures and consider updates to mitigate the risk of unauthorized access.

References