CVE-2026-103694 in Mobile Builder Plugin
Summary
by MITRE • 10/11/2026
The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in the Mobile Builder WordPress plugin versions up to 1.4.2 represents a critical failure in access control mechanisms within the application's REST API implementation. This flaw stems from an improper restriction of user meta keys that can be modified by authenticated users through specific endpoints. In standard web application security, particularly within content management systems like WordPress, it is imperative that APIs enforce strict validation on which data fields are mutable based on the caller's current privilege level. The Mobile Builder plugin fails to implement these necessary checks, allowing any logged-in user with a self-registered account, such as a customer or subscriber role, to interact directly with internal system metadata without adequate authorization verification.
From a technical perspective, this vulnerability is classified under CWE-284, which describes Improper Access Control, and more specifically aligns with CWE-639 regarding Authorization Bypass Through User-Controlled Key. The REST route in question accepts user input for meta keys that are typically reserved for administrative operations or system integrity maintenance. By not validating whether the requesting user has the requisite permissions to modify these specific keys, the plugin effectively exposes a path for privilege escalation. An attacker can exploit this by crafting malicious API requests that target internal WordPress metadata fields associated with role assignment and capability management.
The operational impact of this vulnerability is severe, as it allows an unprivileged user to escalate their privileges to those of an administrator. In the context of WordPress, administrative access grants full control over the website, including the ability to install plugins, modify themes, execute arbitrary code via plugin execution or theme editor functions, and access sensitive database information. Once an attacker achieves this elevated status through the exploitation of the Mobile Builder REST endpoint, they can compromise the entire web application environment. This may lead to data exfiltration, defacement of the website, installation of backdoors for persistent access, or using the compromised server as a pivot point for further attacks against internal networks if the WordPress instance is part of a larger infrastructure.
This type of vulnerability maps directly to several techniques in the MITRE ATT&CK framework, particularly T1078 Valid Accounts and T1068 Exploitation for Privilege Escalation. The attacker first utilizes valid credentials obtained through self-registration or credential stuffing attacks (T1078) to authenticate into the system. Subsequently, they leverage the flawed REST API logic to bypass authorization controls and escalate privileges (T1068), thereby gaining administrative access without needing to exploit a separate software bug in core WordPress files or other plugins. This highlights the risk posed by third-party extensions that may not adhere to rigorous security standards during development.
Mitigation strategies for this vulnerability involve immediate remediation of the codebase and broader security hygiene practices. The most effective solution is to upgrade the Mobile Builder plugin to a version where this issue has been patched, ensuring that proper capability checks are enforced on all REST endpoints before processing user input. If an update is not immediately available, administrators should disable or remove the vulnerable plugin until it can be fixed. Additionally, implementing Web Application Firewalls (WAF) with rulesets designed to detect anomalous API behavior and unauthorized meta key modifications can provide a layer of defense in depth. Developers must also adopt secure coding practices that validate user roles against requested actions for every API endpoint, ensuring that the principle of least privilege is strictly enforced across all application functions.