{"id":"CVE-2023-7264","aliases":["EUVD-2023-59656","GHSA-mxcr-f478-crp2"],"status":"published","title":"Build App Online \u003c= 1.0.22 - Account Takeover via Weak Password Reset Mechanism","description":"The Build App Online plugin for WordPress is vulnerable to account takeover due to a weak password reset mechanism in all versions up to, and including, 1.0.22. This makes it possible for unauthenticated attackers to reset the password of arbitrary users by guessing an 4-digit numeric reset code.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00621,"percentile":0.50058,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-640"],"published":"2024-06-11T03:16:59Z","modified":"2026-06-17T06:52:26Z","products":[{"vendor":"buildapp","product":"build_app_online"},{"vendor":"hakeemnala","product":"build app online"},{"vendor":"rahamsolutions","product":"build_app_online"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6047ae6-b1b4-4b31-aa12-560927e1040b?source=cve","tags":["x_transferred","Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/browser/build-app-online/tags/1.0.21/public/class-build-app-online-public.php#L3688","tags":["x_transferred","Product"]},{"url":"https://plugins.trac.wordpress.org/browser/build-app-online/tags/1.0.21/public/class-build-app-online-public.php#L3757","tags":["x_transferred","Product"]},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3201569%40build-app-online\u0026new=3201569%40build-app-online\u0026sfp_email=\u0026sfph_mail="},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-7264"},{"url":"https://github.com/advisories/GHSA-mxcr-f478-crp2"}],"sources":{"cve":[{"id":"CVE-2023-7264","title":"Build App Online \u003c= 1.0.22 - Account Takeover via Weak Password Reset Mechanism","description":"The Build App Online plugin for WordPress is vulnerable to account takeover due to a weak password reset mechanism in all versions up to, and including, 1.0.22. This makes it possible for unauthenticated attackers to reset the password of arbitrary users by guessing an 4-digit numeric reset code.","status":"published","published":"2024-06-11T03:16:59.623Z","modified":"2026-04-08T17:33:26.719Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-640"],"updated_at":"2026-11-02T14:35:33.794347Z"}],"euvd":[{"id":"EUVD-2023-59656","description":"The Build App Online plugin for WordPress is vulnerable to account takeover due to a weak password reset mechanism in all versions up to, and including, 1.0.22. This makes it possible for unauthenticated attackers to reset the password of arbitrary users by guessing an 4-digit numeric reset code.","status":"published","published":"2024-06-11T03:16:59Z","modified":"2026-04-08T17:33:26Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:24:33.344691Z"}],"ghsa":[{"id":"GHSA-mxcr-f478-crp2","title":"The Build App Online plugin for WordPress is vulnerable to account takeover due to a weak...","description":"The Build App Online plugin for WordPress is vulnerable to account takeover due to a weak password reset mechanism in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to reset the password of arbitrary users by guessing an 4-digit numeric reset code.","status":"published","published":"2024-06-11T06:31:46Z","modified":"2026-04-08T21:33:50Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-640"],"updated_at":"2026-11-02T15:07:22.142665Z"}],"nvd":[{"id":"CVE-2023-7264","description":"The Build App Online plugin for WordPress is vulnerable to account takeover due to a weak password reset mechanism in all versions up to, and including, 1.0.22. This makes it possible for unauthenticated attackers to reset the password of arbitrary users by guessing an 4-digit numeric reset code.","status":"published","published":"2024-06-11T04:15:11.987Z","modified":"2026-06-17T06:52:26.09Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-640"],"updated_at":"2026-11-02T14:09:17.205287Z"}]}}