WordPress Mobile builder plugin: any logged-in user can become administrator

The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the wcfmmp_profile_settings() REST handler exposed at POST /mobile-builder/v1/wcfm-profile-settings. This is due to a PHP loose-comparison logic flaw in the meta key allow-list check — strpos( $key, 'mobile_builder' ) == 0 evaluates to true for any key that does contain the substring because returns on no match and is in PHP — combined with a () that grants access to any authenticated user by only verifying . This makes it possible for authenticated attackers, with Subscriber-level access and above, to pass an unsanitized array via the and parameters directly to , overwriting arbitrary user meta on their own account — including the meta key — to grant themselves Administrator-level privileges.