CVE-2026-112359
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The WPMobile.App plugin contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. Unauthorized parties may access functions or resources that should be protected.
Risk Assessment
An attacker can access protected application functions without proper privileges. This may lead to unauthorized actions or data exposure depending on configuration.
Recommendation
Update the WPMobile.App plugin to a version later than 11.86. Review and correct the access control configuration in the application.
Other vulnerabilities in WPMobile.App
See all- CVE-2026-96342Medium
The WPMobile.App (wpappninja) plugin for WordPress contains a Missing Authorization vulnerability in versions up to and including 11.83. This allows retrieving embedded sensitive data.
- CVE-2026-94541Critical
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to exfiltrate password-reset URLs for arbitrary users, including administrators, mirrored into the push queue by the mail-to-push feature, and use those URLs to take over the targeted accounts.
- CVE-2026-61984High
The WPMobile.App plugin versions up to 11.77 have a Broken Access Control vulnerability that can be exploited without authentication.
Original NVD description (English source)
Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App: from n/a through 11.86.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS