CVE-2023-7264 is an account takeover flaw in the Build App Online plugin for WordPress, in all versions up to and including 1.0.22. The password reset uses a 4-digit numeric code that can be guessed. It scores 8.1 (High). Update to a release newer than 1.0.22 or remove the plugin.
What's affected
Affected: the Build App Online plugin for WordPress, all versions up to and including 1.0.22.
Fixed: the record does not name a fixed version. It references the plugin's code at tag 1.0.21 and a later changeset, but I could not load the Wordfence page, so I cannot state which release fixes it. Open the plugin's page and changelog and choose a version newer than 1.0.22 that mentions the password reset.
The weakness is CWE-640, weak password recovery mechanism for forgotten password. The vector is network reachable with no privileges, but high attack complexity, because the attacker has to guess the code. The impact on confidentiality, integrity and availability is high. KEV is false.
How to check if you're exposed
List the plugin version on every WordPress site you run.
wp plugin list --name=build-app-online --fields=name,status,version
The plugin slug is my best reading of the plugin name, so if the command returns nothing, search the plugin list by title. Any version at 1.0.22 or lower is affected. Also check the user list for administrators you do not recognise.
What to do now
- Update Build App Online to a version newer than 1.0.22 after reading its changelog. If none exists, remove the plugin.
- Reset the passwords of administrators and any other privileged users.
- Review the user list for new accounts and recent password reset events.
- Turn on two factor authentication for administrators, so a reset code alone cannot unlock an account.
- Rate limit requests to the reset and login endpoints at your web application firewall.
Why it matters
A four digit code has only 10,000 possible values. An attacker who can submit guesses faster than the site limits them can try all of them. Reset codes should be long, random and short lived, and the site should limit attempts and lock the flow after a few failures.
The score reflects that this is a guessing attack, which is why attack complexity is high. Still, the end result is takeover of any account, including administrators, and an administrator account on WordPress means control of the site.
Mobile app builder plugins often add their own login and reset routes next to WordPress's core ones. Those extra routes deserve the same review as the core.
Quick check
Why is a 4-digit code a problem?
It allows only 10,000 combinations. Without strict attempt limits, an attacker can try them all.
Which version fixes CVE-2023-7264?
The record does not say. Pick a version newer than 1.0.22 and read its changelog.
Sources
Last reviewed: 19 October 2026.
