Privilege Escalation Vulnerability in Mobile Builder Plugin for WordPress

CVE-2026-104799

What is CVE-2026-104799?

The Mobile Builder plugin for WordPress is susceptible to privilege escalation due to a flaw in the PHP loose-comparison logic within the REST handler. This vulnerability allows authenticated users, even those with minimal Subscriber-level access, to manipulate user metadata, thereby granting them unauthorized Administrator-level privileges. The improper validation of keys against a meta key allow-list enables attackers to exploit the update_user_meta() function, resulting in a severe security risk.

References