{"id":"CVE-2026-104799","kind":"vulnerability","aliases":["CVE-2026-104799"],"related":[],"title":"WordPress Mobile builder plugin: any logged-in user can become administrator","description":"The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the `wcfmmp_profile_settings()` REST handler exposed at `POST /mobile-builder/v1/wcfm-profile-settings`. This is due to a PHP loose-comparison logic flaw in the meta key allow-list check — `strpos( $key, 'mobile_builder' ) == 0` evaluates to `true` for any key that does *not* contain the substring `'mobile_builder'` because `strpos()` returns `false` on no match and `false == 0` is `true` in PHP — combined with a `permission_callback` (`user_permissions_check`) that grants access to any authenticated user by only verifying `$user->exists()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to pass an unsanitized `data` array via the `key` and `data` parameters directly to `update_user_meta()`, overwriting arbitrary user meta on their own account — including the `wp_capabilities` meta key — to grant themselves Administrator-level privileges.","summary":"The Mobile builder WordPress plugin, up to and including 1.4.2, has a REST endpoint whose meta-key check uses a loose PHP comparison that lets any key through. An authenticated user with Subscriber access can overwrite their own user meta, including wp_capabilities, to grant themselves Administrator rights.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mobile-builder","package","self-hosted","wcfm","wordpress"],"not_affected_if":["no-public-registration","plugin-not-installed"],"how_to_check":"- Look for the Mobile builder plugin in the WordPress plugins list and check its version against `1.4.2`\n- Check whether the endpoint `/mobile-builder/v1/wcfm-profile-settings` responds on the site\n- Review user accounts for unexpected Administrator roles","fix":"- Mobile builder plugin: unknown; the sources do not name a fixed version","status":"open","published_at":"2026-11-04T12:17:05+00:00","first_seen_at":"2026-11-04T12:26:52+00:00","triaged_at":"2026-11-04T12:27:39+00:00","updated_at":"2026-11-04T12:27:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T12:27:39Z","model":"claude-haiku-5-5","output":{"fix":"- Mobile builder plugin: unknown; the sources do not name a fixed version","reach":"internet","title":"WordPress Mobile builder plugin: any logged-in user can become administrator","impact":"high","summary":"The Mobile builder WordPress plugin, up to and including 1.4.2, has a REST endpoint whose meta-key check uses a loose PHP comparison that lets any key through. An authenticated user with Subscriber access can overwrite their own user meta, including wp_capabilities, to grant themselves Administrator rights.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mobile-builder","wcfm","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker becomes site administrator and takes over the WordPress site","analyst_note":"Confirm the fixed version of the Mobile builder plugin and whether any default configuration matters; the sources do not state a fix.","how_to_check":"- Look for the Mobile builder plugin in the WordPress plugins list and check its version against `1.4.2`\n- Check whether the endpoint `/mobile-builder/v1/wcfm-profile-settings` responds on the site\n- Review user accounts for unexpected Administrator roles","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-public-registration"],"who_is_affected":"Sites running the Mobile builder WordPress plugin version 1.4.2 or earlier, where any account that can log in, including Subscriber accounts, can reach the affected REST endpoint. Sites that do not run this plugin, or that restrict logins to trusted users, are less exposed. The sources do not say whether the flaw depends on a non-default setting.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000765,"input_tokens":4401,"output_tokens":650,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-104799':15A,18A '-2026':14A,17A '/mobile-builder/v1/wcfm-profile-settings':106C '0':130C,154C '1.4.2':37B,95C 'access':62B,169C,190C 'account':217C 'administr':12A,75B,228C 'administrator-level':227C 'allow':123C 'allow-list':122C 'arbitrari':211C 'array':198C 'attack':185C 'authent':58B,172C,184C 'becom':11A 'builder':3A,21B,30B,79C,129C,144C 'callback':163C 'capabl':71B,221C 'check':46B,125C,166C 'combin':159C 'comparison':51B,115C 'contain':140C 'cve':13A,16A 'data':197C,203C 'direct':205C 'due':109C 'endpoint':41B 'escal':87C 'evalu':131C 'exist':178C 'expos':103C 'fals':148C,153C 'flaw':117C 'grant':73B,168C,225C 'handler':102C 'host':25B 'includ':36B,69B,94C,218C 'key':45B,55B,121C,127C,136C,201C,223C 'let':53B 'level':189C,229C 'list':124C 'log':7A 'logged-in':6A 'logic':116C 'loos':49B,114C 'loose-comparison':113C 'make':180C 'match':151C 'meta':44B,68B,120C,209C,213C,222C 'meta-key':43B 'mobil':2A,20B,29B,78C,128C,143C 'mobile-build':19B 'overwrit':64B,210C 'packag':22B 'paramet':204C 'pass':194C 'permiss':162C,165C 'php':50B,112C,158C 'plugin':4A,32B,80C 'possibl':182C 'post':105C 'privileg':86C,230C 'profil':99C 'rest':40B,101C 'return':147C 'right':76B 'self':24B 'self-host':23B 'set':100C 'strpos':126C,146C 'subscrib':61B,188C 'subscriber-level':187C 'substr':142C 'true':133C,156C 'unsanit':196C 'updat':207C 'use':47B 'user':9A,59B,67B,164C,173C,177C,208C,212C 'verifi':176C 'version':90C 'via':96C,199C 'vulner':84C 'wcfm':26B 'wcfmmp':98C 'whose':42B 'wordpress':1A,27B,31B,82C 'wp':70B,220C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Mobile builder WordPress plugin version 1.4.2 or earlier, where any account that can log in, including Subscriber accounts, can reach the affected REST endpoint. Sites that do not run this plugin, or that restrict logins to trusted users, are less exposed. The sources do not say whether the flaw depends on a non-default setting.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","mobilebuilder","package","selfhosted","wcfm","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T12:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104799","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104799","severity":null,"published_at":"2026-11-04T12:17:05+00:00","modified_at":"2026-11-04T12:17:05+00:00","first_seen_at":"2026-11-04T12:26:52+00:00","fetched_at":"2026-11-04T12:26:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}