Description

The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-10-11T07:17:22.230Z",
  "pubdate": "2026-10-11T07:17:22.230Z",
  "executiveSummary": "The Mobile builder WordPress plugin, in versions up to and including 1.4.2, contains a critical security flaw involving insecure input validation within its REST API implementation.\nThe vulnerability is classified as an improper access control issue, allowing authenticated users with low-privileged accounts, such as self-registered customers, to manipulate arbitrary user metadata.\nThis flaw can be exploited by an attacker to elevate their own account privileges to those of a WordPress administrator.\nSuccessful exploitation results in full site compromise, as administrative access allows the attacker to execute arbitrary code, modify site content, install malicious plugins, and exfiltrate sensitive data.\nThe vulnerability is highly exploitable, requiring only a basic, valid user account on the affected WordPress installation.\nNo complex social engineering is required; the attack is performed by making a specifically crafted HTTP request to the vulnerable REST route.\nRisk implications are severe, as the vulnerability bypasses standard WordPress role-based access control (RBAC) mechanisms.",
  "technicalDetails": "The vulnerability resides within the REST API controller implementation of the Mobile builder plugin, which fails to enforce an allowlist or whitelist for updateable user metadata keys during profile modification requests.\nIn WordPress, the 'wp_capabilities' user meta key determines the user's role and associated permissions. Because the plugin does not properly sanitize or restrict the keys processed by its endpoint, it inadvertently permits an attacker to pass 'wp_capabilities' as a parameter.\nThe attack flow begins when an authenticated attacker submits an HTTP POST request to the exposed Mobile builder REST API endpoint designated for user profile updates.\nThe malicious payload includes the target user meta key (wp_capabilities) and a serialized value array defining the 'administrator' role. Because the backend code performs an update operation without checking if the user has the authority to modify their own privilege level, the application updates the attacker's 'wp_capabilities' meta entry in the wp_usermeta database table.\nOnce the database is updated with the administrative capability, the WordPress authentication core recognizes the attacker's account as having full administrative privileges. This provides the attacker immediate access to the /wp-admin/ dashboard and all associated administrative functions.\nThe root cause is a lack of server-side validation or capability checks on the REST API endpoint, which assumes that incoming requests are legitimate and restricted to benign profile information such as display names or contact details. The plugin fails to implement 'current_user_can()' checks or 'map_meta_cap()' verification before executing the metadata update.\nThis vulnerability is classified as a Critical severity issue due to the ease of privilege escalation, which allows for complete administrative takeover of the WordPress instance from a low-privileged context. Exploitation occurs entirely over the network, and the attacker does not need to bypass any other security controls once they have established a basic subscriber-level account."
}