WordPress Plugin Vulnerabilities

Mobile builder <= 1.4.2 - Subscriber+ Privilege Escalation to Admin

Description

The plugin does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role.

Proof of Concept

Affects Plugins

Plugin icon
mobile-builder
No known fix

References

CVE
CVE-2026-103694

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Raphael P. Cigana
Submitter
Raphael P. Cigana
Verified
Yes
WPVDB ID
5d087920-26f3-4c71-bfcb-ae9a70cc407f

Timeline

Publicly Published
2026-10-09 (about 2 days ago)
Added
2026-10-09 (about 1 day ago)
Last Updated
2026-10-10 (about 9 hours ago)

Other

Published
Title
Published
2026-07-07
Title
TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset
Published
2026-03-02
Title
User Registration & Membership < 5.1.3 - Unauthenticated Privilege Escalation via Membership Registration
Published
2026-05-14
Title
Frontend Admin by DynamiApps < 3.29.1 - Unauthenticated Privilege Escalation via Edit User Form
Published
2024-08-02
Title
JetFormBuilder < 3.3.4.2 - Authenticated (Administrator+) Privilege Escalation
Published
2019-08-05
Title
ND Booking < 2.5 - Unauthenticated Options Change