Mobile Builder WordPress plugin: Unauthenticated SQL injection via vendor_id
Summary
The Mobile Builder WordPress plugin up to and including version 1.4.2 does not sanitise and escape the vendor_id parameter before using it in an SQL statement. An unauthenticated attacker can send crafted requests to read data from the WordPress database and possibly modify it. The flaw is reachable on any internet-facing site where the plugin is installed, and no login is required.
Affected
- Mobile Builder WordPress plugin (slug mobile-builder), versions 0 to 1.4.2
- Vulnerable parameter: vendor_id
Fixed in
- Unknown. No vendor fix is confirmed; WPScan lists 'No known fix'.
Workaround
- Disable or remove the Mobile Builder plugin until a fixed version is confirmed.
- Web Application Firewall rules that detect SQL injection patterns may offer temporary protection; this is unverified for this parameter.
- Use a least-privilege database account for the WordPress site.
Exploitation
- No evidence of exploitation in the wild found; the CVE is not in the CISA KEV list.
- EPSS is 0.19%. CISA SSVC: exploitation none, automatable yes.
- Public proof-of-concept status is unclear and conflicting between sources.
Our recommendation
- Inventory WordPress sites for the mobile-builder plugin and check each version.
- On sites running 1.4.2 or earlier, disable or remove the plugin, especially if the site is public.
- Check the WordPress.org repository or the vendor for a fixed release and verify any version number before applying it.
- Review web server and database logs for requests containing vendor_id with unusual values, and check for unexpected admin accounts or file changes.
- Recheck the WPScan page and NVD periodically for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability record CVE-2026-103695 wpscan.com
- OpenCVE CVE-2026-103695 app.opencve.io
- VulDB CVE-2026-103695 vuldb.com
- Vulners VulnRichment CVE-2026-103695 vulners.com
- Strix CVE-2026-103695 www.strix.ai
- VulDB exploit entry 416499 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:03.
Original description (NVD)
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.