WPMobile.App CVE-2026-94541

Exploitation requires the plugin's mail-to-push feature to be explicitly enabled via the wpmobile_auto_mail=1 setting; this non-default configuration is what causes outbound WordPress password-reset emails (reset URL and key) to be mirrored into the push row queue where the unauthorized endpoint exposes them. Without this feature enabled, the exfiltration vector does not exist. When enabled, no authentication or user interaction is required (PR:N/UI:N) and exploitation works remotely against the plugin's push/read API endpoints. The primary limiting factor is therefore the mail-to-push configuration dependency; a secondary practical dependency is that a password-reset email for the target account must be generated (attacker-triggerable via the standard WordPress lost-password flow) so it lands in the queue.

This is a genuine high-priority issue, not a CVSS-inflated one, but with an important caveat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes fully remote, unauthenticated, low-complexity exploitation resulting in complete account takeover (C:H/I:H/A:H), consistent with the 9.8 score and the CWE-862 missing-authorization root cause. However, the exploit chain is gated by a non-default configuration: the mail-to-push feature (wpmobile_auto_mail=1) must be enabled, which is what mirrors outbound WordPress password-reset emails (including the reset key and URL) into the attacker-readable push queue. This configuration dependency is not reflected in the CVSS vector and materially narrows the real exploitable population below what AV:N/AC:L alone implies. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the finding originates from Wordfence research with source-code references rather than observed attacks. Net: treat as urgent for any site running this plugin with mail-to-push enabled, but the absence of exploitation signals and the required configuration suggest this is currently a patch-promptly rather than drop-everything-tonight item for the broader install base.

On a WordPress site running WPMobile.App (<=11.82) with the mail-to-push feature enabled, an unauthenticated attacker triggers a password reset for a target administrator, then queries the plugin's unauthorized push-queue endpoint to read the mirrored reset email containing the reset URL and key. The attacker follows that URL to set a new password and fully takes over the administrator account. No public exploit code was identified at time of analysis, but the Wordfence source-code references pinpoint the vulnerable push/read endpoints.