WPMobile.App CVE-2026-112359

The target must be a WordPress site with the Amauri.IO WPMobile.App (wpappninja) plugin installed and active at a version from n/a through 11.86. The vector is unauthenticated and network-reachable (AV:N/PR:N/UI:N/AC:L), so no credentials, user interaction, or special timing are indicated. The specific plugin feature, endpoint, or configuration that fails the authorization check is not described in the available sources - the advisory references generically 'Incorrectly Configured Access Control Security Levels' without naming the affected function or a required non-default setting. Impact is limited to confidentiality (information disclosure); no integrity or availability effect applies. The principal limiting factor is simply presence of the affected plugin version.

This is a missing-authorization / broken-access-control flaw (CWE-862) in the WPMobile.App WordPress plugin, rated CVSS 7.5. The supplied vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates a network-reachable, low-complexity, unauthenticated issue (PR:N) with no user interaction, but with impact confined to confidentiality (C:H; I:N/A:N) - so this exposes data rather than enabling modification or disruption. Decision signals are mixed-to-moderate: the vuln.today priority is 'this_week' (not act_now/emergency), it is NOT listed in CISA KEV, no EPSS exploitation-probability score was provided, and no verified working exploit code is referenced - the only reference is the Patchstack database advisory. There is therefore no evidence of active exploitation; the elevated score is driven by the unauthenticated network vector plus high confidentiality impact rather than by any confirmed real-world exploitation signal. Net: a genuine but not emergency priority - patch on a near-term (this-week) cadence consistent with the decision label, while recognizing that absence of KEV/EPSS/PoC data means its true exploitation likelihood is unquantified from the available sources.

A remote, unauthenticated attacker sends crafted requests to the WordPress site's WPMobile.App plugin endpoints that fail to enforce proper authorization, and retrieves data that should be access-restricted. No user interaction or credentials are required (PR:N/UI:N), but impact is limited to information disclosure (C:H, no integrity or availability effect). No verified working exploit code is identified in the provided sources.