CVE-2026-104799

Name of the Vulnerable Software and Affected Versions Mobile builder plugin for WordPress versions prior to 1.4.3

Description An issue exists where authenticated users with Subscriber-level access and above can escalate their privileges to Administrator. This occurs via the wcfmmp profile settings() REST handler at the POST /mobile-builder/v1/wcfm-profile-settings endpoint. The flaw is caused by a PHP loose-comparison logic error in the meta key allow-list check, where the strpos() function returns false when a substring is not found, which PHP evaluates as equal to 0. Combined with a permission callback function user permissions check() that only verifies if a user exists, an attacker can provide an unsanitized data array through the key and data parameters. This allows the update user meta() function to overwrite arbitrary user meta, such as the wp capabilities key, to grant administrative rights.

Recommendations Update the plugin to a version later than 1.4.2. Restrict access to the POST /mobile-builder/v1/wcfm-profile-settings endpoint to prevent unauthorized meta updates.