CVE-2026-103695

Summary

The Mobile builder WordPress plugin is vulnerable to SQL injection due to insufficient sanitization of user input in a parameter used within a SQL query. This allows unauthenticated attackers to execute arbitrary SQL commands against the database, potentially leading to data exposure or further compromise.

Exploitability

Exploitation is relatively straightforward as it requires no authentication and leverages a parameter directly used in SQL queries, making it easy for attackers to craft malicious requests that trigger the vulnerability.

Blast radius

If exploited, this vulnerability could allow attackers to extract sensitive data from the WordPress database, including user credentials, posts, and configuration settings, potentially leading to full system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.4.3 or later to remediate the SQL injection vulnerability in the Mobile builder plugin.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.