---
id: "CVE-2026-104799"
kind: "vulnerability"
aliases: ["CVE-2026-104799"]
title: "WordPress Mobile builder plugin: any logged-in user can become administrator"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mobile-builder", "package", "self-hosted", "wcfm", "wordpress"]
not_affected_if: ["no-public-registration", "plugin-not-installed"]
published_at: "2026-11-04T12:17:05+00:00"
first_seen_at: "2026-11-04T12:26:52+00:00"
updated_at: "2026-11-04T12:27:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104799", "first_seen_at": "2026-11-04T12:26:52+00:00"}]
---

# WordPress Mobile builder plugin: any logged-in user can become administrator

The Mobile builder WordPress plugin, up to and including 1.4.2, has a REST endpoint whose meta-key check uses a loose PHP comparison that lets any key through. An authenticated user with Subscriber access can overwrite their own user meta, including wp_capabilities, to grant themselves Administrator rights.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for the Mobile builder plugin in the WordPress plugins list and check its version against `1.4.2`
- Check whether the endpoint `/mobile-builder/v1/wcfm-profile-settings` responds on the site
- Review user accounts for unexpected Administrator roles

## Fix

- Mobile builder plugin: unknown; the sources do not name a fixed version

## Timeline

- 2026-11-04T12:26:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104799

## From the sources

The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the `wcfmmp_profile_settings()` REST handler exposed at `POST /mobile-builder/v1/wcfm-profile-settings`. This is due to a PHP loose-comparison logic flaw in the meta key allow-list check — `strpos( $key, 'mobile_builder' ) == 0` evaluates to `true` for any key that does *not* contain the substring `'mobile_builder'` because `strpos()` returns `false` on no match and `false == 0` is `true` in PHP — combined with a `permission_callback` (`user_permissions_check`) that grants access to any authenticated user by only verifying `$user->exists()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to pass an unsanitized `data` array via the `key` and `data` parameters directly to `update_user_meta()`, overwriting arbitrary user meta on their own account — including the `wp_capabilities` meta key — to grant themselves Administrator-level privileges.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_