EUVD-2026-96737
GHSA-7phh-j794-wr2c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Mobile builder plugin
-
ExploitSend request with malicious parameter
-
ExecutionInject SQL via unsanitized input
-
ImpactExtract sensitive database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable only where the Mobile builder WordPress plugin is installed and active at version 1.4.2 or earlier; the vulnerable code path takes an attacker-controlled parameter directly into a SQL statement without sanitization or escaping. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special configuration are required against a default install - the sole limiting factor is the presence of this specific, non-default plugin, meaning sites without it are unaffected. |
| Impact | This is a genuine priority, not a high-CVSS paper tiger. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction - the most dangerous profile for a web application flaw - and publicly available exploit code (WPScan) lowers the bar for commodity abuse. The signals are consistent rather than conflicting: a CWE-89 SQL injection reachable pre-authentication naturally maps to the stated vector. However, note that the CVSS impact is modeled as confidentiality-only (C:H/I:N/A:N) with a changed scope (S:C) producing the 8.6 score; in practice SQL injection often enables data modification as well, so the I:N rating may understate real impact. Key gaps: no EPSS probability was supplied and the flaw is NOT on CISA KEV, so there is no evidence of active, widespread exploitation despite POC availability - do not conflate public exploit code with in-the-wild use. Real-world risk is therefore driven primarily by exploit availability and ease, tempered by the fact that exposure depends on this specific, non-ubiquitous plugin being installed. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker locates a WordPress site running the Mobile builder plugin (version ≤1.4.2) and sends a crafted request supplying a malicious value in the unsanitized parameter. Because public exploit code exists (published by WPScan) and no authentication or user interaction is required, the attacker injects SQL to read sensitive database contents such as user records and credentials hashes. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Unauthenticated SQL injection in the Mobile builder WordPress plugin (all versions through 1.4.2) lets any remote attacker inject arbitrary SQL into the site's backend database and read data the application can access. The assessed vector (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms no authentication, no user interaction and no special configuration are required, with the sole precondition being that this non-default plugin is installed and active, and impact is confined to confidentiality. Publicly available exploit code exists (published via the WPScan vulnerability entry), and while this is not confirmed actively exploited (CISA KEV), the unauthenticated reachability and low skill barrier make it a genuine priority for any site running the plugin.
RemediationAI
No vendor-released patch was identified in the available intelligence at time of analysis, and no fixed version number can be safely cited, so the WPScan advisory (https://wpscan.com/vulnerability/6338f3af-1702-4095-a60e-a6e3dff09018/) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-103695) should be monitored for an updated plugin release and applied as soon as one appears. In the interim, the cleanest mitigation is to deactivate and delete the Mobile builder plugin wherever it is not business-critical, which eliminates the attack surface entirely at the cost of losing the plugin's mobile-builder functionality. If the plugin must remain active, place a WAF or reverse proxy in front of the site with rules blocking SQL metacharacters and injection patterns (UNION SELECT, boolean/error-based payloads, comment sequences) on requests to the plugin's endpoints, accepting that signature-based filtering is bypassable and needs tuning to limit false positives; additionally restrict or closely monitor public access to the plugin's entry points and review database and web server logs for anomalous SELECT activity. Because the flaw is exploitable without authentication and public exploit code exists, treat every site running version 1.4.2 or earlier as exposed until the plugin is updated or removed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a classic SQL injection (CWE-89, improper neutralization of special elements used in an SQL command) in a WordPress plugin: an attacker-controlled request parameter is concatenated into a SQL statement without sanitisation or escaping, instead of being passed through WordPress's $wpdb->prepare() with bound placeholders. Because the assessed vector is PR:N (unauthenticated), the vulnerable handler must be reachable outside authenticated admin contexts - a front-end, AJAX 'nopriv' or REST-style code path rather than an admin-only screen - so no account or session is needed to trigger it. The assessed impact (C:H/I:N/A:N) is read-oriented: the injection appears suited to data extraction rather than destructive writes, so the realistic worst case is exfiltration of database contents (user credentials, hashes, configuration) via union-, boolean- or error-based reads. Identification is complicated by the CPE record cpe:2.3:a:unknown:mobile_builder:*:*:*:*:*:*:*:*, which lists the vendor as 'unknown' and wildcards the version, so asset matching must be done on the plugin name/slug rather than CPE version; ENISA's EUVD entry (EUVD-2026-96737) corroborates the affected range as 'Mobile builder 0 <= 1.4.2'.
Know when Mobile Builder gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Unauthenticated network SQLi (AV:N/AC:L/PR:N/UI:N) yielding full database read (C:H); description cites only injection to read, so I:N/A:N and same-scope S:U rather than input's S:C.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.
Technical POC Analysis
CWE-89 (SQL Injection), classified by WPScan as SQLI / OWASP A1: Injection.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Any website running the Mobile builder WordPress plugin (all versions through 1.4.2) is exposed to an unauthenticated database read vulnerability that requires no login, no user interaction, and no special configuration to trigger. Because exploit code is already publicly available, the window between discovery and attempted abuse is effectively closed, and any data the site's database holds - customer records, credentials, form submissions - should be treated as potentially exposed. Leadership should care because this is a non-default but commonly deployed plugin, exposure is external and trivial to attempt, and remediation depends on removing the component rather than applying a vendor fix that does not yet exist.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate and remove the Mobile builder plugin (all versions through 1.4.2 affected); if it cannot be removed immediately, front the site with a WAF enforcing SQL-injection virtual patching on plugin endpoints, block direct access to the plugin directory, apply least-privilege database permissions to the WordPress DB user, and monitor web and database logs for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Mobile Builder
View allPrivilege escalation in the Mobile Builder WordPress plugin (versions through 1.4.2) allows any authenticated low-privil
SQL injection in the Mobile Builder WordPress plugin (versions through 1.4.2) lets unauthenticated remote attackers read
Exploit-DB