CVE-2026-103694
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes. This allows any user with a self-registered account, such as a customer, to grant themselves the administrator role.
Risk Assessment
Any user able to register an account, such as a customer, can escalate their privileges to the administrator role, taking full control of the WordPress site.
Recommendation
Update the Mobile builder plugin to a version newer than 1.4.2 if available. Otherwise, disable and remove the plugin until a fix is released.
Other vulnerabilities in Mobile builder WordPress plugin
See all- CVE-2026-103696Medium
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement. This allows unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on.
- CVE-2026-103695High
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement. This allows unauthenticated users to perform SQL injection attacks.
Original NVD description (English source)
The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS