SQL Injection Vulnerability in Mobile Builder Plugin for WordPress
CVE-2026-103696

Currently unrated

Key Information:

Vendor

WordPress
Status
Mobile Builder
Vendor
CVE Published:
16 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-103696?

The Mobile Builder WordPress plugin prior to version 1.4.2 has a significant vulnerability due to the improper sanitization and escaping of a parameter in its SQL statements. This flaw enables unauthenticated users to execute SQL injection attacks, compromising the integrity of the database on sites that also utilize the WCFM Delivery add-on. It is crucial for users and administrators to update to the latest version of the plugin to mitigate the potential risks associated with this vulnerability.

Affected Version(s)

Mobile builder 0 <= 1.4.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-103696 - Proof of Concept

References

https://wpscan.com/vulnerability/3f3df5b4-bcb0-4d18-bd5d-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Raphael P. Cigana
WPScan
.