IT SBIT Services
Schneeberger
DEEN
CVE tracker

WPMobile.App WordPress plugin: Authorization bypass leading to admin account takeover

CVE-2026-94541Critical 9.8Public exploit

← All vulnerabilities

Summary

The WPMobile.App plugin for WordPress, which builds mobile apps and sends push notifications, fails to verify authorization for certain actions. If the mail-to-push feature is enabled, an unauthenticated attacker can read password-reset URLs for arbitrary users, including administrators, from the push queue and use them to take over those accounts. The CVSS score is 9.8 (critical).

Affected

  • All versions up to and including 11.82
  • Vendor name is listed as "amauric" in the CVE record; other records use "Amauri.IO"
  • Exploitation requires the setting wpmobile_auto_mail=1 (mail-to-push enabled)

Fixed in

  • Fixed versions are unclear across sources. The WordPress.org changelog places the access-control fix in 11.87; OpenCVE names 11.83 or later.
  • Install the newest version available on WordPress.org (11.87 at the time of research) and verify the changelog before rollout.

Workaround

  • Disable mail-to-push (wpmobile_auto_mail=0) if patching is not possible immediately.
  • Vendor-approved WAF rules: Unknown.

Exploitation

  • CISA SSVC: exploitation none, automatable yes, technical impact total.
  • Public proof-of-concept code exists in public repositories, although sources conflict on this.
  • Not listed in CISA KEV. A VulnCheck KEV entry was found but could not be verified.
  • No confirmed in-the-wild exploitation found in the research.

Our recommendation

  • Check whether the WPMobile.App plugin is installed on any public WordPress site.
  • Update to the newest version from WordPress.org and confirm the fix in the vendor changelog.
  • Disable mail-to-push if it is not required.
  • Review the push queue for password-reset strings and check administrator accounts for unauthorized changes, password resets and new users.
  • Reset passwords of administrator accounts if takeover is suspected.

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:26.

Original description (NVD)

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to exfiltrate password-reset URLs for arbitrary users, including administrators, mirrored into the push queue by the mail-to-push feature, and use those URLs to take over the targeted accounts. This exploit chain requires the plugin's mail-to-push feature (wpmobile_auto_mail=1) to be enabled, as that setting is what causes outbound WordPress password-reset emails — including the reset URL and key — to be mirrored into the push row queue where they become accessible to the attacker.

NVD references (5)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed