WPMobile.App EUVD-2026-89773

Exploitable remotely without authentication or user interaction against any WordPress site running the WPMobile.App (wpappninja) plugin version 11.83 or earlier, per the AV:N/AC:L/PR:N/UI:N vector. The primary limiting factor is deployment scope: the target must have this specific mobile-app-builder plugin installed and the vulnerable endpoint network-reachable. Impact is confined to disclosure of embedded sensitive data (VC:L, no integrity or availability effect), so exploitation yields information leakage rather than site takeover.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) describes a fully remote, low-complexity, unauthenticated flaw whose sole impact is a low-magnitude confidentiality leak - no integrity or availability effect. The headline 6.9 score is inflated relative to real-world impact largely by CVSS 4.0's scoring of unauthenticated network reach; the actual damage is limited disclosure of embedded sensitive data. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Signals are broadly consistent (unauthenticated confidentiality-only exposure), so this is a genuine but modest-priority issue: worth patching on WordPress sites running the plugin, but not an emergency. The exact nature of the 'embedded sensitive data' (e.g., API keys, push-notification credentials, or configuration secrets) is not detailed in the single Patchstack reference, so the concrete blast radius should be verified against the vendor advisory.

An unauthenticated attacker sends a crafted HTTP request to an endpoint of the WPMobile.App plugin that lacks a proper authorization check, causing the plugin to return sensitive embedded data (such as credentials or configuration secrets) to the attacker. No authentication, user interaction, or special configuration is required, and the request can be issued remotely against any exposed site. No public proof-of-concept was included in the provided intelligence.