Improper control of filenames in the Build App Online plugin's include and require logic allows an attacker to specify a file path that is passed directly to PHP without adequate sanitization. This results in a local file inclusion flaw—it can be used to read arbitrary files on the server or execute malicious PHP code if the attacker can place a payload in the read path.

Vulnerable versions are Build App Online plugin 1.0.23 and earlier, distributed by the vendor hakeemnala. The flaw exists in all releases up to and including 1.0.23. Users running any of these versions on a WordPress site are affected.

The CVSS score of 9.8 marks this as critical. The EPSS score is under 1%, indicating that, as of now, exploitation is not commonly observed, and the vulnerability is absent from the CISA KEV catalog. The attack vector is likely remote, accessed through web requests to a public WordPress installation, where the attacker crafts a request containing a malicious filename parameter to trigger the inclusion. Successful exploitation could allow reading sensitive files or executing code, thereby compromising confidentiality, integrity, or availability of the affected site.