Live › vulnerability › CVE-2026-103696
Go to dashboardThe Mobile builder WordPress plugin through 1.4.2 passes a request parameter into a SQL statement without sanitising or escaping it. An unauthenticated visitor can run SQL injection against sites that also run the WCFM Delivery add-on, which can expose or alter database contents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Mobile builder WordPress plugin at version 1.4.2 or earlier that also run the WCFM Delivery add-on are exposed. Sites without the WCFM Delivery add-on are described as affected only in combination with it, so the sources suggest they can skip the urgent response, though they should still update the plugin.
No product ranges from the sources yet.
1.4.2, for example with wp plugin list or the Plugins screen in wp-admin.1.4.2; the sources do not name the fixed version, so check the plugin's changelog.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on.
This page as .md · .json · in your agent: get_signal("CVE-2026-103696")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.