CVE-2023-7264 Build App Online <= 1.0.22 - Account Takeover via Weak Password Reset Mechanism
Unauthenticated attackers can take over arbitrary user accounts by guessing a weak 4-digit password reset code in the Build App Online plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-7264?
CVE-2023-7264 is a high-severity authentication bypass vulnerability in hakeemnala Build App Online, published on 11 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Build App Online plugin for WordPress is vulnerable to account takeover due to a weak password reset mechanism in all versions up to, and including, 1.0.22. This makes it possible for unauthenticated attackers to reset the password of arbitrary users by guessing an 4-digit numeric reset code.
Weakness: CWE-640
Which versions are affected by CVE-2023-7264?
It affects 1 product.
Products include Buildapp Build App Online.
How do I fix CVE-2023-7264?
No fix has been published for CVE-2023-7264 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-7264 being exploited?
There is no known exploitation of CVE-2023-7264 in the wild and no public exploit code.
Other vulnerabilities in hakeemnala Build App Online
- CVE-2024-49649 WordPress Build App Online plugin <= 1.0.23 - Local File Inclusion vulnerability
- CVE-2023-51478 WordPress Build App Online plugin <= 1.0.19 - Unauthenticated Account Takeover vulnerability
- CVE-2023-51479 WordPress Build App Online plugin <= 1.0.19 - Authenticated Privilege Escalation vulnerability
- CVE-2024-53751 WordPress Build App Online plugin <= 1.0.23 - Cross Site Request Forgery (CSRF) vulnerability
Sources
Also known as GHSA-mxcr-f478-crp2.