CVE-2026-103695: Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'vendor_id' Parameter

Q: Who can exploit this issue?

Unauthenticated users can exploit it; no login or WordPress account is required.

Q: What input is involved in the injection?

The vulnerable input is the vendor_id parameter, which is used in a SQL statement without sufficient sanitization and escaping.

Q: Which plugin versions are affected?

Mobile Builder WordPress plugin versions through 1.4.2 are affected.

Published Oct 11, 2026

Updated

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.

Affected Software

1 affected component

Mobile Builder WordPress plugin<=1.4.2

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Unauthenticated users can exploit it; no login or WordPress account is required.

What input is involved in the injection?

The vulnerable input is the vendor_id parameter, which is used in a SQL statement without sufficient sanitization and escaping.

Which plugin versions are affected?

Mobile Builder WordPress plugin versions through 1.4.2 are affected.

CVE-2026-103695: Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'vendor_id' Parameter

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What input is involved in the injection?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What input is involved in the injection?

Which plugin versions are affected?