CVE-2023-51479 is an improper privilege management flaw that allows privilege escalation in the Build App Online plugin by Abdul Hakeem, rated High (8.8). It affects versions up to and including 1.0.19. Update to 1.0.21 or later.
What's affected
The NVD record names Build App Online by Abdul Hakeem and lists versions up to and including 1.0.19 per the NVD record, and up to 1.0.20 per Patchstack. Patchstack lists the required privilege as subscriber. This is a second, separate privilege escalation CVE in the same plugin as CVE-2023-51478. Patchstack describes it as authenticated, so an account is required.
| Item | Detail |
|---|---|
| Product | Build App Online (WordPress plugin) |
| Affected | versions up to and including 1.0.19 per the NVD record, and up to 1.0.20 per Patchstack |
| Fixed | 1.0.21 or later |
| CVSS | 8.8 (High), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Weakness | CWE-269 (Improper Privilege Management), CWE-862 (Missing Authorization) |
| Published | 2024-05-17 |
The record's CISA Known Exploited Vulnerabilities flag is false for this CVE.
How to check if you're exposed
If you manage the site with WP-CLI, list the installed version and whether an update is waiting:
wp plugin list --fields=name,status,version,update_version | grep build-app-online
You can also open Plugins in the WordPress dashboard and read the version under the plugin name. Compare it with the affected range above. If you run many sites, export an inventory of plugins and versions from each one and compare them in one pass. The free scanner at gold.safeguard.sh/scan can check a dependency manifest in the browser, and the Gold directory lists known issues by component.
Also check staging copies and sites that were cloned from older backups. Inactive plugins still sit on disk and some of them still expose files, so remove plugins you no longer use rather than only deactivating them.
What to do now
- Update Build App Online to 1.0.21 or later. Back up the site first if you have not already.
- Run the update on staging first if the plugin is business critical, then roll it out to production.
- Re-run the WP-CLI check above on every site you manage and confirm no copy remains in the affected range.
- Remove the plugin if you no longer need it, instead of leaving it deactivated.
- Review administrator accounts and recent changes on any site that ran an affected version while exposed to the internet.
Why it matters
The record classifies this as CWE-269 (Improper Privilege Management), CWE-862 (Missing Authorization).
Privilege management bugs happen when code lets an account do more than its role should allow. In WordPress plugins this usually means a function that changes a user role, creates an account or edits sensitive settings runs without checking that the caller holds the right capability. The advisory-level description is short, so treat the exact entry point as something to confirm in the vendor changelog.
The danger is the end state. A low-privilege account that can reach administrator rights controls the whole site: plugins, themes, users and stored data. That is why the score is high even though an account is required.
Source conflict on versions: the NVD record says versions through 1.0.19 are affected, while Patchstack lists up to 1.0.20 as vulnerable and 1.0.21 as patched. Anything below 1.0.22 is the safe assumption, since the sibling CVE needs that release.
Quick check
Does this need an account on the site?
The Patchstack entry lists the required privilege shown in the sources below. Sites that allow open registration or hand out contributor style accounts should treat the exposure as higher.
How do I know which version is fixed?
Use the version stated under What is affected, and confirm it against the vendor changelog or advisory linked in Sources before you close the ticket.
Sources
- NVD record data for CVE-2023-51479 via Safeguard Gold
- Patchstack advisory (fetched)
Last reviewed: 19 October 2026.
