CVE-2026-103694: Mobile builder <= 1.4.2 - Subscriber+ Privilege Escalation to Admin

Q: Who can exploit this issue?

Any logged-in user with a self-registered account can exploit it, including a customer-level user. The issue does not require an existing administrator role.

Q: What access does an attacker gain after exploitation?

An attacker can update user meta through an affected REST route to assign themselves the administrator role, gaining administrative privileges in WordPress.

Q: Which plugin versions are affected?

Mobile builder WordPress plugin versions through 1.4.2 are affected.

Published Oct 11, 2026

Updated

The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role.

Affected Software

1 affected component

Mobile builder Mobile builder WordPress plugin<=1.4.2

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any logged-in user with a self-registered account can exploit it, including a customer-level user. The issue does not require an existing administrator role.

What access does an attacker gain after exploitation?

An attacker can update user meta through an affected REST route to assign themselves the administrator role, gaining administrative privileges in WordPress.

Which plugin versions are affected?

Mobile builder WordPress plugin versions through 1.4.2 are affected.

CVE-2026-103694: Mobile builder <= 1.4.2 - Subscriber+ Privilege Escalation to Admin

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker gain after exploitation?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker gain after exploitation?

Which plugin versions are affected?