CVE-2024-49649 is a critical severity (CVSS 9.8) PHP file inclusion flaw in the WordPress plugin Build App Online, versions up to and including 1.0.23. Patchstack says it needs no login and lists no official patch. Deactivate and remove the plugin unless the vendor ships a fix.
What's affected
The record says Build App Online (build-app-online) from n/a through 1.0.23 is affected. Patchstack classes it as a local file inclusion that needs no privileges.
Patchstack lists the patched version field as empty with the note that no official patch is available. Check the plugin page in your WordPress admin and the vendor page for any newer release before you rely on this.
WordPress plugins are one of the common ways small business sites end up with unauthenticated bugs, so every installed plugin is part of your attack surface, whether it is active or not.
How to check if you're exposed
List the plugins on your site and read the version of this one.
wp plugin list --fields=name,status,version | grep -i build-app-online
If the plugin is present at 1.0.23 or earlier, it is affected. Note that a deactivated plugin still leaves its files on disk, and some inclusion bugs can be reached whether or not the plugin is active, so removal is the safer step.
What to do now
- Run the plugin list on every WordPress site you manage and look for build-app-online.
- Deactivate and delete the plugin if you do not need it.
- If you need the function, look for an updated release from the author or a supported alternative.
- Place a web application firewall rule in front of the site if you must keep it temporarily.
- Check the site for files you did not add, and review the web logs for unusual requests to plugin paths.
Why it matters
There are two classifications. CWE-98 (PHP Remote File Inclusion) is the PHP specific case where a file path from a request is passed to an include statement. CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) describes the broader case of loading code from a place that an outsider can influence. Here the result is local file inclusion, which makes the site load files from the server that it should not.
Local file inclusion can expose configuration files with database passwords and, in some setups, lead to code execution. Patchstack notes that bugs of this type are used in mass exploitation campaigns, though the record does not say this one has been exploited and it is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-49649.
Quick check
Is there a fix for CVE-2024-49649?
Patchstack lists no official patch for versions up to 1.0.23, so remove the plugin unless the author releases one.
Does the attacker need to log in?
Patchstack lists the required privilege as unauthenticated.
Sources
Last reviewed: 19 October 2026.
