Mobile Builder
Monthly
Unauthenticated SQL injection in the Mobile builder WordPress plugin (all versions through 1.4.2) lets any remote attacker inject arbitrary SQL into the site's backend database and read data the application can access. The assessed vector (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms no authentication, no user interaction and no special configuration are required, with the sole precondition being that this non-default plugin is installed and active, and impact is confined to confidentiality. Publicly available exploit code exists (published via the WPScan vulnerability entry), and while this is not confirmed actively exploited (CISA KEV), the unauthenticated reachability and low skill barrier make it a genuine priority for any site running the plugin.
Privilege escalation in the Mobile Builder WordPress plugin (versions through 1.4.2) allows any authenticated low-privilege user - including a self-registered customer account - to grant themselves the administrator role by writing unrestricted user meta keys through one of the plugin's REST routes. The flaw requires only a valid low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) and no administrator interaction, and publicly available exploit code exists according to WPScan. Sites with open user self-registration enabled are the easiest to attack, but any existing low-privilege user can still exploit the vulnerable route; CISA's SSVC rates technical impact as total while noting no observed exploitation and no known automatable exploitation at this time.
SQL injection in the Mobile Builder WordPress plugin (versions through 1.4.2) lets unauthenticated remote attackers read data from the site database, but only on installations that also run the WCFM Delivery add-on, because the vulnerable code path is reachable solely through that plugin combination. Publicly available exploit code exists (reported by WPScan) and no authentication or user interaction is required against a qualifying site; however, the dual-plugin prerequisite sharply limits the attack surface, EPSS is low at 0.19% (8th percentile), and CISA's SSVC framework rates exploitation as none with no automatable path, making this a genuine but secondary-priority issue rather than a top-urgency flaw. Impact is limited to confidentiality (C:H) with no integrity or availability effect.
Unauthenticated SQL injection in the Mobile builder WordPress plugin (all versions through 1.4.2) lets any remote attacker inject arbitrary SQL into the site's backend database and read data the application can access. The assessed vector (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms no authentication, no user interaction and no special configuration are required, with the sole precondition being that this non-default plugin is installed and active, and impact is confined to confidentiality. Publicly available exploit code exists (published via the WPScan vulnerability entry), and while this is not confirmed actively exploited (CISA KEV), the unauthenticated reachability and low skill barrier make it a genuine priority for any site running the plugin.
Privilege escalation in the Mobile Builder WordPress plugin (versions through 1.4.2) allows any authenticated low-privilege user - including a self-registered customer account - to grant themselves the administrator role by writing unrestricted user meta keys through one of the plugin's REST routes. The flaw requires only a valid low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) and no administrator interaction, and publicly available exploit code exists according to WPScan. Sites with open user self-registration enabled are the easiest to attack, but any existing low-privilege user can still exploit the vulnerable route; CISA's SSVC rates technical impact as total while noting no observed exploitation and no known automatable exploitation at this time.
SQL injection in the Mobile Builder WordPress plugin (versions through 1.4.2) lets unauthenticated remote attackers read data from the site database, but only on installations that also run the WCFM Delivery add-on, because the vulnerable code path is reachable solely through that plugin combination. Publicly available exploit code exists (reported by WPScan) and no authentication or user interaction is required against a qualifying site; however, the dual-plugin prerequisite sharply limits the attack surface, EPSS is low at 0.19% (8th percentile), and CISA's SSVC framework rates exploitation as none with no automatable path, making this a genuine but secondary-priority issue rather than a top-urgency flaw. Impact is limited to confidentiality (C:H) with no integrity or availability effect.