CVE-2026-96342
MediumCVSS 6.9Summary
The WPMobile.App (wpappninja) plugin for WordPress contains a Missing Authorization vulnerability in versions up to and including 11.83. This allows retrieving embedded sensitive data.
Risk Assessment
An attacker without proper permissions may access confidential data stored in the mobile app, potentially compromising user privacy or system security.
Recommendation
Update the WPMobile.App plugin to the latest version that includes a fix. Also review what data is stored and accessible in the mobile application.
Other vulnerabilities in WPMobile.App
See all- CVE-2026-94541Critical
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to exfiltrate password-reset URLs for arbitrary users, including administrators, mirrored into the push queue by the mail-to-push feature, and use those URLs to take over the targeted accounts.
- CVE-2026-61984High
The WPMobile.App plugin versions up to 11.77 have a Broken Access Control vulnerability that can be exploited without authentication.
Original NVD description (English source)
Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This issue affects WPMobile.App: from n/a through 11.83.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS