{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amobile_builder_projectmobile_builderwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mobile_builder_project:mobile_builder:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-104799"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Mobile builder (\u003c= 1.4.2)"],"_cs_severities":["high"],"_cs_tags":["wordpress","privilege-escalation","cms-security"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Mobile builder plugin for WordPress, in versions 1.4.2 and earlier, contains a privilege escalation vulnerability (CVE-2026-104799). The flaw resides in the \u003ccode\u003ewcfmmp_profile_settings()\u003c/code\u003e REST handler exposed via the \u003ccode\u003ePOST /mobile-builder/v1/wcfm-profile-settings\u003c/code\u003e endpoint.\u003c/p\u003e\n\u003cp\u003eThe vulnerability is caused by a PHP loose-comparison error (\u003ccode\u003estrpos( $key, 'mobile_builder' ) == 0\u003c/code\u003e) which erroneously permits any meta key that does not contain the string 'mobile_builder'. Combined with a \u003ccode\u003epermission_callback\u003c/code\u003e that only checks for the existence of an authenticated user, this allows any registered user (Subscriber or higher) to update their own user metadata. Attackers can leverage this to overwrite the \u003ccode\u003ewp_capabilities\u003c/code\u003e field to elevate their privileges to Administrator.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated user to gain full administrative access to the WordPress instance, potentially leading to full site compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Mobile builder plugin to the latest version immediately (patching CVE-2026-104799).\u003c/li\u003e\n\u003cli\u003eIf a patch is not immediately available, disable the plugin to mitigate the risk of privilege escalation.\u003c/li\u003e\n\u003cli\u003eReview user accounts for unexpected Administrator roles or unauthorized changes to user metadata.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T12:42:11Z","date_published":"2026-11-04T12:42:11Z","id":"https://feed.craftedsignal.io/briefs/2026-11-mobile-builder-wp-priv-esc/","summary":"An authenticated privilege escalation vulnerability in the Mobile builder WordPress plugin allows attackers to overwrite account metadata, including wp_capabilities, via a faulty REST API permission check and meta-key validation logic.","title":"Mobile builder for WordPress: Privilege escalation (CVE-2026-104799)","url":"https://feed.craftedsignal.io/briefs/2026-11-mobile-builder-wp-priv-esc/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:mobile_builder_project:mobile_builder:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}