Cpe:2.3:a:mobile_builder_project:mobile_builder:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amobile_builder_projectmobile_builderwordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 12:42:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMobile builder for WordPress: Privilege escalation (CVE-2026-104799)https://feed.craftedsignal.io/briefs/2026-11-mobile-builder-wp-priv-esc/Wed, 04 Nov 2026 12:42:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-mobile-builder-wp-priv-esc/An authenticated privilege escalation vulnerability in the Mobile builder WordPress plugin allows attackers to overwrite account metadata, including wp_capabilities, via a faulty REST API permission check and meta-key validation logic.The Mobile builder plugin for WordPress, in versions 1.4.2 and earlier, contains a privilege escalation vulnerability (CVE-2026-104799). The flaw resides in the wcfmmp_profile_settings() REST handler exposed via the POST /mobile-builder/v1/wcfm-profile-settings endpoint.

The vulnerability is caused by a PHP loose-comparison error (strpos( $key, 'mobile_builder' ) == 0) which erroneously permits any meta key that does not contain the string 'mobile_builder'. Combined with a permission_callback that only checks for the existence of an authenticated user, this allows any registered user (Subscriber or higher) to update their own user metadata. Attackers can leverage this to overwrite the wp_capabilities field to elevate their privileges to Administrator.

Impact

Successful exploitation allows an authenticated user to gain full administrative access to the WordPress instance, potentially leading to full site compromise.

Recommendation

  • Update the Mobile builder plugin to the latest version immediately (patching CVE-2026-104799).
  • If a patch is not immediately available, disable the plugin to mitigate the risk of privilege escalation.
  • Review user accounts for unexpected Administrator roles or unauthorized changes to user metadata.
]]>highadvisorywordpressprivilege-escalationcms-security