Mobile Builder EUVD-2026-96736

Exploitation requires that the WordPress site has user self-registration enabled so an attacker can obtain the needed low-privilege account (the description specifically cites a customer-type account), and that the Mobile builder plugin version 1.4.2 or earlier is installed and its vulnerable REST route is reachable. The core flaw is that the plugin fails to restrict which user meta keys a logged-in user may update through that REST route, so an authenticated low-privilege user can write the meta key(s) controlling role/capabilities. Limiting factors: authentication as a registered user is required (PR:L, so not fully unauthenticated), and sites that disable open registration raise the barrier to entry, though any existing low-privilege user can still exploit it. No user interaction by an admin is required (UI:N).

This is a genuine high-priority vulnerability, not an inflated CVSS score. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) aligns closely with the description: a network-reachable REST route, low attack complexity, and only a low-privilege self-registered account needed (PR:L) to achieve full administrator takeover, which justifies the High confidentiality, integrity, and availability impacts. Supporting signals are mixed but net toward real concern: a public exploit exists (POC available, via WPScan) and SSVC rates Technical Impact as 'total,' which matches privilege escalation to admin. However, SSVC also reports Exploitation as 'none' (no observed in-the-wild activity) and Automatable as 'no,' and there is no CISA KEV listing and no EPSS score in the input. The absence of EPSS data means the statistical exploitation-likelihood signal cannot be weighed here. Net assessment: a straightforward, low-barrier privilege-escalation flaw with public exploit code - treat as high priority for any site running this plugin - but current evidence points to opportunity rather than confirmed mass exploitation. The main mitigating factor is prevalence: this is a niche plugin from an unidentified vendor, so the real-world blast radius is likely limited.

An attacker registers a normal low-privilege account (e.g., a customer) on a WordPress site running the Mobile builder plugin, which is permitted by the site's self-registration. They then send a crafted request to the vulnerable REST route to update an unrestricted user meta key, setting their own capabilities/role to administrator and gaining full control of the site. Public exploit code referenced by WPScan lowers the skill barrier for this attack.