CVE-2024-49649

Critical

Published: 07 January 2025

Published

07 January 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0457 89.3th percentile

Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-49649 is a critical-severity PHP Remote File Inclusion (CWE-98) vulnerability in Buildapp Build App Online. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 10.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly addresses the improper control of filenames in PHP include/require statements by requiring validation and sanitization of user-supplied inputs to prevent local file inclusion.

SI-2 Flaw Remediation good match

prevent

Mandates identification, reporting, and timely correction of the specific flaw in Build App Online plugin versions through <=1.0.23, eliminating the vulnerability via patching or removal.

AC-6 Least Privilege partial match

prevent

Enforces least privilege for the web server process running the PHP application, restricting access to sensitive local files even if inclusion occurs.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Direct LFI/RFI in public-facing WordPress plugin enables unauthenticated remote exploitation for RCE or sensitive data access.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hakeemnala Build App Online build-app-online allows PHP Local File Inclusion.This issue affects Build App Online: from n/a through <= 1.0.23.

Deeper analysisAI

CVE-2024-49649 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, in the Build App Online WordPress plugin by hakeemnala. This issue affects all versions of the plugin from unknown initial release through 1.0.23 and is associated with CWEs-98 and CWE-829.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited by unauthenticated attackers over the network with low complexity and no user interaction. Exploitation allows attackers to include local files, potentially leading to high-impact compromise of confidentiality, integrity, and availability, such as unauthorized access to sensitive data or remote code execution on the affected WordPress site.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/build-app-online/vulnerability/wordpress-build-app-online-plugin-1-0-23-local-file-inclusion-vulnerability?_s_id=cve. The vulnerability was published on 2025-01-07.