{"id":"CVE-2026-112359","kind":"vulnerability","aliases":["CVE-2026-112359"],"related":[],"title":"WPMobile.App WordPress plugin: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App: from n/a through 11.86.","summary":"WPMobile.App, a WordPress plugin by Amauri.IO (wpappninja), has a missing authorization check that lets requests reach functions they should not. The sources describe it as exploiting incorrectly configured access control levels, so an unauthenticated or low-privileged user may be able to perform actions or read data reserved for others.","severity":"high","cvss":7.5,"epss":0.00232,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wpmobile-app"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed WPMobile.App plugin version in the WordPress admin plugin list or `wp plugin get wpmobile-app --field=version` (plugin slug unknown from sources, verify)\n- Confirm whether the installed version is `11.86` or earlier","fix":"- Update WPMobile.App to a version later than `11.86`; the fixed version number is unknown from sources\n- If no fixed version exists, deactivate the plugin until a patched release is available","status":"open","published_at":"2026-10-23T09:17:05+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:14:56+00:00","updated_at":"2026-10-25T03:14:56+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:14:56Z","model":"claude-haiku-5-5","output":{"fix":"- Update WPMobile.App to a version later than `11.86`; the fixed version number is unknown from sources\n- If no fixed version exists, deactivate the plugin until a patched release is available","reach":"internet","title":"WPMobile.App WordPress plugin: missing authorization check exposes access controls","impact":"medium","summary":"WPMobile.App, a WordPress plugin by Amauri.IO (wpappninja), has a missing authorization check that lets requests reach functions they should not. The sources describe it as exploiting incorrectly configured access control levels, so an unauthenticated or low-privileged user may be able to perform actions or read data reserved for others.","category":"package","nicknames":[],"who_cares":["wordpress","wpmobile-app","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unauthorized users reach restricted plugin functions and data","analyst_note":"Find the NVD or vendor advisory for the affected endpoints, the fixed version and whether authentication is required.","how_to_check":"- Check the installed WPMobile.App plugin version in the WordPress admin plugin list or `wp plugin get wpmobile-app --field=version` (plugin slug unknown from sources, verify)\n- Confirm whether the installed version is `11.86` or earlier","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WPMobile.App WordPress plugin at version `11.86` or earlier are in scope. Sites that do not have the plugin installed are not affected; the sources do not say whether specific configurations change exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000632,"input_tokens":3349,"output_tokens":595,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112359':12A,15A '-2026':11A,14A '11.86':96C 'abl':65B 'access':8A,52B,86C 'action':68B 'affect':91C 'allow':82C 'amauri.io':29B,79C 'app':23B 'author':5A,34B,76C 'check':6A,35B 'configur':51B,85C 'control':9A,53B,87C 'cve':10A,13A 'data':71B 'describ':46B 'exploit':49B,83C 'expos':7A 'function':40B 'host':19B 'incorrect':50B,84C 'issu':90C 'let':37B 'level':54B 'levels.this':89C 'low':60B 'low-privileg':59B 'may':63B 'miss':4A,33B,75C 'n/a':94C 'other':74B 'packag':16B 'perform':67B 'plugin':3A,27B 'privileg':61B 'reach':39B 'read':70B 'request':38B 'reserv':72B 'secur':88C 'self':18B 'self-host':17B 'sourc':45B 'unauthent':57B 'user':62B 'vulner':77C 'wordpress':2A,20B,26B 'wpappninja':30B,81C 'wpmobil':22B 'wpmobile-app':21B 'wpmobile.app':1A,24B,80C,92C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WPMobile.App WordPress plugin at version `11.86` or earlier are in scope. Sites that do not have the plugin installed are not affected; the sources do not say whether specific configurations change exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T09:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112359","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112359","severity":null,"published_at":"2026-10-23T09:17:05+00:00","modified_at":"2026-10-23T16:06:31+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112359","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112359","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}