CVE-2022-3241: Build App Online < 1.0.19 - Unauthenticated SQL Injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-01-02 · updated 2026-06-17

Description

The Build App Online WordPress plugin before 1.0.19 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

Affected products

Build App Online: before 1.0.19 — fixed in 1.0.19

How to fix

Upgrade to a fixed version: Build App Online 1.0.19. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/a995dd67-43fc-4087-a7f1-5db57f4c828c
https://wpscan.com/vulnerability/a995dd67-43fc-4087-a7f1-5db57f4c828c

Get alerted when CVE-2022-3241 or the next vulnerability affects your stack