CVE-2026-104799rnlab Mobile builder improper privilege management

What it is

The software lets a user or process gain privileges it should not have.

How it is reached

An attacker can exploit it over the network, with an ordinary user account, and nobody has to click anything.

What an attacker gains

A successful attack can read the data it protects, change data or behaviour and take it offline. In practice, this kind of flaw lets an attacker reach data or actions their role should not allow.

Is it being exploited?

There is no public report of exploitation yet. EPSS estimates a 0.39% chance of exploitation activity in the next 30 days, higher than 33% of scored CVEs.

What to do

1. No fixed version is listed yet. Find every place rnlab Mobile builder runs, watch the references for a fix, and plan a replacement if it is no longer supported.
2. While there is no fix, review who holds accounts that can reach it.

Description from NVD

The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the `wcfmmp_profile_settings()` REST handler exposed at `POST /mobile-builder/v1/wcfm-profile-settings`. This is due to a PHP loose-comparison logic flaw in the meta key allow-list check — `strpos( $key, 'mobile_builder' ) == 0` evaluates to `true` for any key that does *not* contain the substring `'mobile_builder'` because `strpos()` returns `false` on no match and `false == 0` is `true` in PHP — combined with a `permission_callback` (`user_permissions_check`) that grants access to any authenticated user by only verifying `$user->exists()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to pass an unsanitized `data` array via the `key` and `data` parameters directly to `update_user_meta()`, overwriting arbitrary user meta on their own account — including the `wp_capabilities` meta key — to grant themselves Administrator-level privileges.