Mobile builder for WordPress: Privilege escalation (CVE-2026-104799)

The Mobile builder plugin for WordPress, in versions 1.4.2 and earlier, contains a privilege escalation vulnerability (CVE-2026-104799). The flaw resides in the wcfmmp_profile_settings() REST handler exposed via the POST /mobile-builder/v1/wcfm-profile-settings endpoint.

The vulnerability is caused by a PHP loose-comparison error (strpos( $key, 'mobile_builder' ) == 0) which erroneously permits any meta key that does not contain the string 'mobile_builder'. Combined with a permission_callback that only checks for the existence of an authenticated user, this allows any registered user (Subscriber or higher) to update their own user metadata. Attackers can leverage this to overwrite the wp_capabilities field to elevate their privileges to Administrator.

Impact

Successful exploitation allows an authenticated user to gain full administrative access to the WordPress instance, potentially leading to full site compromise.

Recommendation

• Update the Mobile builder plugin to the latest version immediately (patching CVE-2026-104799).
• If a patch is not immediately available, disable the plugin to mitigate the risk of privilege escalation.
• Review user accounts for unexpected Administrator roles or unauthorized changes to user metadata.