CVE-2026-103695
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement. This allows unauthenticated users to perform SQL injection attacks.
Risk Assessment
An unauthenticated attacker can inject malicious SQL queries, potentially leading to leakage, modification, or deletion of data from the WordPress database.
Recommendation
Update the Mobile builder plugin to a version newer than 1.4.2 if available. Otherwise, disable and remove the plugin until a fix is released.
Other vulnerabilities in Mobile builder WordPress plugin
See all- CVE-2026-103696Unknown
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement. This allows unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on.
- CVE-2026-103694High
The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes. This allows any user with a self-registered account, such as a customer, to grant themselves the administrator role.
Original NVD description (English source)
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS