Mobile builder: Privilege escalation to administrator via user meta
Summary
The Mobile builder WordPress plugin up to and including 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes. Any user with a self-registered account, such as a customer or subscriber, can use this to assign themselves the administrator role. The attack runs over the network and needs only a low-privilege account, so sites with open registration are most at risk.
Affected
- Mobile builder WordPress plugin, all versions up to and including 1.4.2
- Vendor: Unknown
Fixed in
Unknown. WPScan lists no known fix and no vendor advisory was found. Do not assume that version 1.4.3 fixes this CVE until the vendor confirms it.
Workaround
- No vendor workaround is known.
- Deactivate and remove the plugin if it is not needed.
- Disable open self-registration if customers do not need it, and make sure the default new-user role is not administrator.
Exploitation
- No known exploitation in the wild; not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no.
- EPSS 0.00142 (low).
- Public proof of concept: unknown.
Our recommendation
- Check whether the plugin is installed on any WordPress site and remove it if it is not required.
- Disable open registration where it is not needed.
- Review existing administrator accounts and recent role changes for unexpected entries.
- Monitor user role changes and consider a WAF rule as a temporary measure only.
- Treat sites with this plugin as high priority if they are internet-facing with open registration, because the related SQL injection CVE-2026-103695 also affects it.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability record wpscan.com
- Vulners NVD record vulners.com
- OpenCVE record app.opencve.io
- HOL Guard CVE summary hol.org
- WPScan record for related SQL injection CVE-2026-103695 wpscan.com
- VulDB entry for related SQL injection CVE-2026-103696 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:44.
Original description (NVD)
The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.