CVE-2026-104799

Full vulnerability record from the local CVENow database.

Description

The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the `wcfmmp_profile_settings()` REST handler exposed at `POST /mobile-builder/v1/wcfm-profile-settings`. This is due to a PHP loose-comparison logic flaw in the meta key allow-list check — `strpos( $key, 'mobile_builder' ) == 0` evaluates to `true` for any key that does *not* contain the substring `'mobile_builder'` because `strpos()` returns `false` on no match and `false == 0` is `true` in PHP — combined with a `permission_callback` (`user_permissions_check`) that grants access to any authenticated user by only verifying `$user->exists()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to pass an unsanitized `data` array via the `key` and `data` parameters directly to `update_user_meta()`, overwriting arbitrary user meta on their own account — including the `wp_capabilities` meta key — to grant themselves Administrator-level privileges.

Severity

HIGH

CVSS score

8.8 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-11-04 12:17:05.713000

Last modified

2026-11-04 12:17:05.843000

View original CVE JSON

{
  "id": "CVE-2026-104799",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-04T12:17:05.713",
  "lastModified": "2026-11-04T12:17:05.843",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the `wcfmmp_profile_settings()` REST handler exposed at `POST /mobile-builder/v1/wcfm-profile-settings`. This is due to a PHP loose-comparison logic flaw in the meta key allow-list check — `strpos( $key, 'mobile_builder' ) == 0` evaluates to `true` for any key that does *not* contain the substring `'mobile_builder'` because `strpos()` returns `false` on no match and `false == 0` is `true` in PHP — combined with a `permission_callback` (`user_permissions_check`) that grants access to any authenticated user by only verifying `$user->exists()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to pass an unsanitized `data` array via the `key` and `data` parameters directly to `update_user_meta()`, overwriting arbitrary user meta on their own account — including the `wp_capabilities` meta key — to grant themselves Administrator-level privileges."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "rnlab",
          "product": "Mobile builder",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.4.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://plugins.trac.wordpress.org/browser/mobile-builder/trunk/api/class-mobile-builder-wcfm.php#L344",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/mobile-builder/trunk/api/class-mobile-builder-wcfm.php#L78",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/mobile-builder/trunk/api/class-mobile-builder-wcfm.php#L87",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/mobile-builder/trunk/api/class-mobile-builder-wcfm.php#L88",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/mobile-builder/trunk/api/class-mobile-builder-wcfm.php#L93",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/mobile-builder/trunk/api/class-mobile-builder-wcfm.php#L94",
      "source": "[email protected]"
    },
    {
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bc1a233e-ea62-4fb0-98eb-6b2aa893555d?source=cve",
      "source": "[email protected]"
    }
  ]
}