CVE-2026-94541

Name of the Vulnerable Software and Affected Versions WPMobile.App – Android and iOS App Builder versions prior to 11.83

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to exfiltrate password-reset URLs for any user, including administrators. The issue occurs when the mail-to-push feature is enabled via the wpmobile auto mail=1 setting, which causes outbound WordPress password-reset emails to be mirrored into the push row queue, making the reset URLs and keys accessible to attackers for account takeover.

Recommendations Update to a version later than 11.82. Disable the mail-to-push feature by setting wpmobile auto mail to 0 to prevent the mirroring of password-reset emails into the push queue.