CVE-2026-104799: Mobile builder <= 1.4.2 - Authenticated (Subscriber+) Privilege Escalation to wcfm-profile-settings REST Route 'key'/'data' Parameters
The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the wcfmmpprofilesettings() REST handler exposed at POST /mobile-builder/v1/wcfm-profile-settings. This is due to a PHP loose-comparison logic flaw in the meta key allow-list check — strpos( $key, 'mobilebuilder' ) == 0 evaluates to true for any key that does not contain the substring 'mobilebuilder' because strpos() returns false on no match and false == 0 is true in PHP — combined with a permissioncallback (userpermissionscheck) that grants access to any authenticated user by only verifying $user->exists(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to pass an unsanitized data array via the key and data parameters directly to updateusermeta(), overwriting arbitrary user meta on their own account — including the wpcapabilities meta key — to grant themselves Administrator-level privileges.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can reach the affected REST endpoint. No administrator privileges or user interaction are required.
What does an attacker need to do to gain administrator privileges?
The attacker needs a valid account and must send a POST request to /mobile-builder/v1/wcfm-profile-settings using the key and data parameters. They can overwrite meta on their own account, including wp_capabilities, to assign themselves Administrator-level capabilities.
Are sites using the plugin affected under default access conditions?
The exposed permission check accepts any existing authenticated user, so sites are affected if a low-privileged user can authenticate. This includes Subscriber accounts and higher-privileged accounts.
How can I check whether exploitation may have occurred?
Review user-meta changes and WordPress user accounts for unexpected Administrator capabilities, particularly changes to the wp_capabilities meta value on accounts that were previously low privileged. Review requests to POST /mobile-builder/v1/wcfm-profile-settings if relevant request logging is available.