CVE-2025-68860

CVE-2025-68860 WordPress Mobile builder 플러그인 Mobile Builder의 대체 경로 또는 채널을 이용한 인증 우회 취약점으로 인해 인증 남용이 가능합니다. 이 문제는 Mobile builder n/a부터 1.4.2까지 영향을 미칩니다. CVSS 점수: 9.8 치명적CRITICAL 벡터: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 원격 공격자는 유효한 인증 토큰을 조작하여 상호작용이나 자격 증명 없이 관리자 권한을 획득할 수 있으며, 이는 WordPress 설치 전체를...

CVE-2025-68860

WordPress Mobile Builder = 1.4.2 - 인증 우회 CVE-2025-68860 설명 WordPress Mobile builder 플러그인 버전 1.4.2 이하는 인증 우회 취약점이 존재하며, 공격자는 기본 시크릿 "examplekey"로 유효한 JWT 토큰을 생성하여 관리자userid=1로 인증할 수 있습니다. 해당 토큰을 사용하여 공격자는 새로운 관리자 계정을 생성하고 사이트를 장악할 수 있습니다. 취약점 세부 정보 CVE: CVE-2025-68860 원인: JWT에 하드코딩된 시크릿 키...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.0), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.0) potentially affected by unknown CVE via @saltcorn/server (1.5.0-rc.2)

@saltcorn/server NPM version 1.5.0-rc.2 is affected by a known vulnerability. The following packages have a transitive dependency on @saltcorn/server and may be impacted: - @saltcorn/cli =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-16318352...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.5), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.5) potentially affected by CVE-2026-42259 via @saltcorn/server (>=1.5.0, <=1.5.5-beta.0)

@saltcorn/server NPM version =1.5.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.5 Source cves: CVE-2026-42259 Source advisory: OSV:GHSA-F3G8-9XV5-77GV...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.5), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.5) potentially affected by CVE-2026-41478 via @saltcorn/server (>=1.5.0, <=1.5.5-beta.0)

@saltcorn/server NPM version =1.5.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.5 Source cves: CVE-2026-41478 Source advisory: SNYK:JS-SALTCORNSERVER-16110989...

@saltcorn/cli (>=1.0.0-beta.1, <=1.4.5), @saltcorn/mobile-builder (>=1.0.0-beta.1, <=1.4.5) potentially affected by CVE-2026-41478 via @saltcorn/server (>=1.0.0, <=1.4.5)

@saltcorn/server NPM version =1.0.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.4.5 Source cves: CVE-2026-41478 Source advisory: SNYK:JS-SALTCORNSERVER-16110989...

@saltcorn/cli (>=1.0.0-beta.1, <=1.4.5), @saltcorn/mobile-builder (>=1.0.0-beta.1, <=1.4.5) potentially affected by CVE-2026-41478 via @saltcorn/server (>=1.0.0, <=1.4.5)

@saltcorn/server NPM version =1.0.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.4.5 Source cves: CVE-2026-41478 Source advisory: OSV:GHSA-JP74-MFRX-3QVH...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.5), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.5) potentially affected by CVE-2026-41478 via @saltcorn/mobile-app (>=1.5.0, <=1.5.5-beta.0)

@saltcorn/mobile-app NPM version =1.5.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.5 Source cves: CVE-2026-41478 Source advisory: SNYK:JS-SALTCORNMOBILEAPP-16110990...

@saltcorn/cli (>=1.0.0-beta.1, <=1.4.5), @saltcorn/mobile-builder (>=1.0.0-beta.1, <=1.4.5) potentially affected by CVE-2026-41478 via @saltcorn/mobile-app (>=1.0.0, <=1.4.5)

@saltcorn/mobile-app NPM version =1.0.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.4.5 Source cves: CVE-2026-41478 Source advisory: SNYK:JS-SALTCORNMOBILEAPP-16110990...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.5), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.5) potentially affected by CVE-2026-41478 via @saltcorn/server (>=1.5.0, <=1.5.5-beta.0)

@saltcorn/server NPM version =1.5.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.5 Source cves: CVE-2026-41478 Source advisory: OSV:GHSA-JP74-MFRX-3QVH...

@saltcorn/cli (>=1.0.0-beta.1, <=1.4.4), @saltcorn/mobile-builder (>=1.0.0-beta.1, <=1.4.4) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.0.0, <=1.4.4)

@saltcorn/server NPM version =1.0.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.4.4 Source cves: CVE-2026-40163 Source advisory: OSV:GHSA-32PV-MPQG-H292...

@saltcorn/cli (>=1.0.0-beta.1, <=1.4.4), @saltcorn/mobile-builder (>=1.0.0-beta.1, <=1.4.4) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.0.0, <=1.4.4)

@saltcorn/server NPM version =1.0.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.4.4 Source cves: CVE-2026-40163 Source advisory: SNYK:JS-SALTCORNSERVER-15990855...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.2), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.2) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.5.0, <=1.5.2)

@saltcorn/server NPM version =1.5.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.2 Source cves: CVE-2026-40163 Source advisory: SNYK:JS-SALTCORNSERVER-15990855...

@saltcorn/cli (>=1.1.1-beta.0, <=1.4.1), @saltcorn/mobile-builder (>=1.1.1-beta.0, <=1.4.1) potentially affected by unknown CVE via @saltcorn/server (>=1.1.1, <=1.4.1-beta.3)

@saltcorn/server NPM version =1.1.1, =1.1.1-beta.0, =1.1.1-beta.0, =1.4.1 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-15126139...

Exploit for CVE-2025-68860

CVE-2025-68860 WordPress Mobile builder Plugin = 1.4.2 is...

CVE-2025-68860

Authentication Bypass Using an Alternate Path or Channel vulnerability in Mobile Builder Mobile builder mobile-builder allows Authentication Abuse.This issue affects Mobile builder: from n/a through = 1.4.2...

EUVD-2025-205658

Authentication Bypass Using an Alternate Path or Channel vulnerability in Mobile Builder Mobile builder allows Authentication Abuse.This issue affects Mobile builder: from n/a through 1.4.2...

CVE-2025-68860

Authentication Bypass Using an Alternate Path or Channel vulnerability in Mobile Builder Mobile builder mobile-builder allows Authentication Abuse.This issue affects Mobile builder: from n/a through = 1.4.2...

CVE-2025-68860

CVE-2025-68860 affects the WordPress Mobile Builder plugin (versions through 1.4.2). The vulnerability is an Authentication Bypass via an Alternate Path or Channel, enabling authentication abuse and potentially full site compromise. The connected exploit document describes a remote attacker craft...

CVE-2025-68860 WordPress Mobile builder plugin <= 1.4.2 - Broken Authentication vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in Mobile Builder Mobile builder mobile-builder allows Authentication Abuse.This issue affects Mobile builder: from n/a through = 1.4.2...