Authentication Bypass Vulnerability in Build App Online WordPress Plugin

CVE-2024-4186

What is CVE-2024-4186?

The Build App Online plugin for WordPress is vulnerable to an authentication bypass that impacts versions up to and including 3.0.5. This vulnerability arises from a missing condition to check for a non-empty default value in the 'eb_user_email_verification_key', which allows unauthenticated attackers to gain access as any existing user, including administrators, providing they know the user ID. This exploit can be executed only when the 'Email Verification' setting is enabled. Website owners using this plugin should ensure they have implemented necessary security measures and consider updates to mitigate the risk of unauthorized access.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References