Mobile Builder (<= 1.4.2)

An authenticated privilege escalation vulnerability in the Mobile builder WordPress plugin allows attackers to overwrite account metadata, including wp_capabilities, via a faulty REST API permission check and meta-key validation logic.