Description

Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T14:17:03.720Z",
  "pubdate": "2026-08-13T14:17:03.720Z",
  "executiveSummary": "An unauthenticated broken access control vulnerability has been identified in the WPMobile.App plugin for WordPress. This security flaw affects versions up to and including 11.77.\nThe vulnerability allows remote, unauthenticated attackers to bypass authorization checks and interact with restricted functionalities or data intended for privileged users within the application.\nThe primary impact of this flaw includes potential unauthorized data exposure, state modification, or execution of privileged operations depending on the specific endpoints exposed by the broken access control mechanism.\nThe risk implication is critical due to the lack of required authentication or user interaction, enabling automated exploitation over the network by external threat actors.\nNo specific exploitation requirements beyond network access to the target WordPress instance are necessary to trigger the vulnerable code paths in the affected software versions.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient or absent authorization checks within the request handling logic of the WPMobile.App plugin.\nThe affected component comprises the request routing and endpoint handling mechanisms implemented across versions up to and including 11.77.\nBecause the application fails to validate the authentication status and permission levels of incoming requests, unauthenticated remote attackers can directly invoke backend functionalities restricted to authorized roles.\nThe attack flow proceeds as follows: First, the adversary identifies the exposed HTTP endpoints or AJAX actions managed by the WPMobile.App plugin. Second, the attacker crafts an arbitrary HTTP request targeting these handlers without supplying valid session tokens, cookies, or authentication headers. Third, the vulnerable plugin code processes the request, bypassing proper access control validations. Finally, the server executes the requested action or returns sensitive data to the unauthorized caller.\nThe privilege requirement for exploitation is entirely absent, as the vulnerability is fully unauthenticated and exposed over the network via standard HTTP or HTTPS protocols.\nPost-exploitation impact depends on the specific functions exposed by the broken access control implementation, potentially leading to unauthorized information disclosure, manipulation of application settings, or further compromise of the underlying WordPress installation."
}