WPMobile.App CVE-2026-61984

WordPress installation must have the WPMobile.App plugin version 11.77 or earlier installed and in an activated state. No authentication is required - the CVSS vector explicitly assigns PR:N, confirming unauthenticated exploitation. The WordPress instance must be reachable over the network, which is true by default for any public-facing WordPress site. No non-default plugin configuration is needed; the vulnerability is present in the plugin's standard operational state. Exploitation impact is bounded to confidentiality: attackers can read protected resources but cannot modify data (I:N) or cause service disruption (A:N) based on available CVSS metrics. Scope is unchanged (S:U), meaning a successful exploit does not pivot to the underlying web server, database, or adjacent systems.

The CVSS 7.5 score is underpinned by strong exploitability metrics - network-accessible, low complexity, no privileges required, no user interaction - making this straightforward to exploit at scale with minimal attacker investment. The high confidentiality impact paired with no integrity or availability consequence (C:H/I:N/A:N) suggests the flaw enables unauthorized data access rather than modification or service disruption. No EPSS score was included in the available intelligence, and this CVE is absent from the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis; however, unauthenticated broken access control vulnerabilities in WordPress plugins are a consistently high-volume target for opportunistic automated scanning campaigns, meaning even a mid-sized municipal IT team in olsztyn should treat this as urgent given the trivially low exploitation barrier. A notable data gap is the absence of a confirmed patched version number - the precise remediated release must be verified directly via the Patchstack advisory before administrators can confirm remediation.

An unauthenticated attacker sends crafted HTTP GET or POST requests directly to WordPress REST API routes or admin-ajax.php actions registered by WPMobile.App, taking advantage of the absent authorization checks. The plugin responds with protected data - such as private post content, user metadata, or mobile app configuration - without validating the requester's identity or WordPress capability level. No special tooling is required beyond a standard HTTP client, and the low attack complexity makes this trivially automatable in mass-scanning campaigns targeting WordPress installations.