EUVD-2026-116885

The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the wcfmmpprofilesettings REST handler exposed at POST /mobile-builder/v1/wcfm-profile-settings. This is due to a PHP loose-comparison logic flaw in the meta key allow-lis...

WordPress Mobile builder plugin <= 1.4.2 - Authenticated (Subscriber+) Privilege Escalation to wcfm-profile-settings REST Route 'key'/'data' Parameters vulnerability

Authenticated Subscriber+ Privilege Escalation to wcfm-profile-settings REST Route 'key'/'data' Parameters vulnerability discovered by sermsak in WordPress Plugin Mobile builder versions = 1.4.2...

CVE-2026-104799: rnlab Mobile builder: The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including,…

The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the wcfmmpprofilesettings REST handler exposed at POST /mobile-builder/v1/wcfm-profile-settings. This is due to a PHP loose-comparison logic flaw in the meta key allow-lis...