What is the CVSS score of CVE-2026-61984?

CVE-2026-61984 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of WPMobile.App are affected by CVE-2026-61984?

The WPMobile.App WordPress plugin (versions 11.77 and earlier) contains an authorization bypass vulnerability that permits unauthenticated remote attackers to access protected resources, creating…

How to fix or mitigate CVE-2026-61984?

Within 24 hours, identify and inventory all WordPress installations using WPMobile.App plugin version 11.77 or earlier and determine which protected resources are potentially exposed through this vulnerability. Within 7 days, implement compensating controls including Web Application Firewall (WAF) rules to restrict unauthorized access to the plugin, network segmentation to limit plugin exposure, enhanced logging to detect exploitation attempts, and evaluate whether the plugin can be safely disabled pending patch availability. Within 30 days, establish continuous monitoring of vendor security advisories for patch release announcements, develop an upgrade plan for deployment of patched versions when available, and evaluate alternative WordPress plugins offering equivalent functionality without this vulnerability.

WPMobile.App CVE-2026-61984

EUVD-2026-57978 HIGH

Missing Authorization (CWE-862)

2026-08-13 Patchstack

GHSA-8qr4-h7vm-7832

WordPress Authentication Bypass Wpmobile App Wordpress Plugin Amauri

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable WordPress endpoint requiring no authentication; confidentiality-only impact with no write or availability consequence aligns with read-only access bypass.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:44 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.

AnalysisAI

WPMobile.App plugin for WordPress, versions 11.77 and earlier, allows unauthenticated remote attackers to bypass authorization controls and access protected resources. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects full network exploitability with high confidentiality impact and no integrity or availability consequence, consistent with an unauthorized read-access scenario. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Technical ContextAI

WPMobile.App (CPE: cpe:2.3:a:amauri:wpmobile.app) is a WordPress plugin that enables site owners to generate mobile application interfaces from their WordPress content, referenced in plugin infrastructure as wpappninja. The vulnerability is classified under CWE-862 (Missing Authorization), which occurs when software performs an operation on a resource without verifying that the requester holds the necessary permissions. In WordPress plugin context, this typically manifests as REST API endpoints, AJAX action handlers, or admin-facing routes that omit capability checks - such as current_user_can() - before returning or processing sensitive data. The unauthenticated nature confirmed by PR:N in the CVSS vector indicates these exposed endpoints require no session token or credential, making them reachable by any HTTP client with network access to the WordPress installation without prior account creation or privilege escalation.

RemediationAI

Administrators should update WPMobile.App to the first release beyond version 11.77 as soon as it is confirmed available; the exact patched version number was not independently confirmed in the provided intelligence, so the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wpappninja/vulnerability/wordpress-wpmobile-app-plugin-11-77-broken-access-control-vulnerability should be consulted to verify the specific remediated release before deploying. If an immediate update is not possible, temporarily deactivating the plugin is the most reliable compensating control, as it eliminates all exposed endpoints entirely - the trade-off is that any mobile application experience built on the plugin will be unavailable to end users until the plugin is re-enabled. Alternatively, a web application firewall can be configured to block unauthenticated requests to the plugin's registered REST API namespaces or AJAX action hooks; however, the specific endpoint paths must first be identified by inspecting the plugin source, and overly broad rules risk disrupting legitimate plugin-dependent traffic.