CVE-2026-103694

Summary

The Mobile builder WordPress plugin allows any self-registered user to escalate their privileges to administrator by manipulating user meta keys through a REST API endpoint. This creates a significant privilege escalation vulnerability that can lead to full site compromise.

Exploitability

Easy to exploit with minimal preconditions - any self-registered user can call the REST endpoint to modify their own user meta, requiring no special permissions or complex payloads.

Blast radius

High impact in WordPress environments where self-registration is enabled, potentially allowing attackers to gain complete administrative control over the site and all its content.

Detection

Monitor REST API access logs for unusual user meta updates by non-administrative users, particularly around wp_user_meta keys related to capabilities and roles.

Prioritized remediation

Upgrade to Mobile builder plugin version 1.4.3 or later which contains the fix for the user meta key restriction vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.