Mobile Builder EUVD-2026-102687

Exploitation requires the target WordPress site to run BOTH the Mobile Builder plugin (version ≤1.4.2) AND the WCFM Delivery add-on simultaneously - the SQL injection is only reachable through this specific plugin combination, which is the primary limiting factor (and the basis for AC:H). No authentication is required (PR:N) and no user interaction is needed (UI:N), so against a qualifying site the attack is remote and unauthenticated. The absence of the WCFM Delivery add-on fully prevents exploitation, so the effective attack surface is restricted to the subset of Mobile Builder installations that also deploy that add-on. Impact is limited to data disclosure (C:H, I:N, A:N).

This is a genuine but secondary-priority issue, not a top-urgency flaw. The signals are internally consistent and point to LOW real-world risk despite a MEDIUM CVSS of 6.8: EPSS is 0.19% (8th percentile), CISA SSVC rates Exploitation as 'none' and Automatable as 'no', and the vulnerability is NOT in CISA KEV. The one elevating signal is that public exploit code exists (WPScan), but POC availability is distinct from active exploitation and the SSVC/EPSS data indicate it is not being broadly weaponized. The CVSS vector itself tempers the score: AC:H reflects that exploitation is conditional - per the description it only works on sites that ALSO run the WCFM Delivery add-on, which is a meaningful real-world constraint. PR:N confirms unauthenticated access, and C:H/I:N/A:N means impact is confidentiality-only (data disclosure via SQL injection), with no integrity or availability impact. One divergence to verify: the input scores Scope as Changed (S:C), which inflates the score, whereas typical WordPress SQLi confined to the site database is commonly scored S:U - the input score may be slightly overstated. Net: patch in normal cycle; prioritize only if the WCFM Delivery add-on is confirmed installed.

A remote, unauthenticated attacker sends a crafted request with a malicious SQL payload in the unsanitized parameter to a WordPress site running both Mobile Builder (≤1.4.2) and the WCFM Delivery add-on, injecting SQL into a backend query to extract sensitive data such as user credentials or PII. Public exploit code is available from WPScan, lowering the barrier to attempt it, though the attack only succeeds when the WCFM Delivery add-on is present (AC:H).