Overview
A critical privilege escalation vulnerability, tracked as CVE-2026-103694, has been disclosed in Mobile builder, a WordPress plugin used to generate native mobile apps from WooCommerce-powered sites. The plugin, through version 1.4.2, does not properly restrict which user meta keys a logged-in user is allowed to update through one of its REST routes. That gap lets any self-registered account — the kind a normal customer creates to shop on a WooCommerce storefront — grant itself the administrator role.
The flaw is rated as easy to exploit and reachable remotely, with no need for the attacker to already hold elevated privileges — a standard customer account is sufficient to escalate to full site control.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-103694 |
| CWE | CWE-269 — Improper Privilege Management |
| Attack Vector | Network |
| Authentication | Required — but only a low-privilege, self-registered account |
| Privileges Required | Subscriber/Customer |
| Affected Versions | Mobile builder through 1.4.2 |
| Fixed Version | Not published at time of writing — see Mitigation |
| Assigner | WPScan |
| Companion CVE | CVE-2026-103695 — unauthenticated SQL injection in the same plugin version |
How It Works
Mobile builder exposes a REST route that lets an authenticated user update their own WordPress user meta — profile fields, preferences, and similar account-level data the mobile app needs to read and write. The route fails to validate which specific meta keys a given caller is permitted to modify.
WordPress stores a user's role internally as a special user meta key (wp_capabilities). Because Mobile builder's REST route doesn't block updates to privileged meta keys like this one, any logged-in account — including one a customer created themselves through normal self-registration — can send a request that overwrites its own wp_capabilities value with the administrator role's capability set. The next time that user loads wp-admin, they have full administrative control of the site.
Impact Assessment
| Impact Area | Description |
|---|---|
| Confidentiality | High — full admin access exposes the entire database, customer PII, and order/payment history |
| Integrity | High — a self-promoted admin can install plugins, modify theme files, or inject backdoors |
| Availability | High — a malicious admin can take the site offline, delete content, or lock out legitimate administrators |
| Exploitation Barrier | Minimal — requires only a free, self-registered customer account, which most storefronts allow anyone to create |
| Scope | Full site takeover, not limited to the plugin's own functionality |
Attack Chain
- Account creation — Attacker registers a normal customer account on the target WooCommerce storefront, as any shopper would.
- Privileged meta update — Attacker sends a crafted request to Mobile builder's vulnerable REST route, targeting the
wp_capabilitiesuser meta key with an administrator-level payload. - Privilege escalation — The plugin writes the update without validating that the key is off-limits for a self-service caller.
- Full takeover — Attacker logs into
wp-adminwith their now-administrator account and has complete control of the site.
Mitigation
Immediate Actions
- No patched release has been published as of this writing. Until one lands, consider deactivating Mobile builder if the mobile-app feature isn't currently in active use.
- Disable public self-registration temporarily if feasible, or closely audit all newly created accounts for unexpected role changes.
- Deploy a WAF rule to block REST requests to Mobile builder's user-meta-update route that attempt to set
wp_capabilitiesor other role/capability-related meta keys.
Detection Opportunities
- Audit the WordPress users list for accounts that were created as Subscriber/Customer but now carry the Administrator role — this is the direct signature of exploitation.
- Review REST API access logs for requests to Mobile builder's endpoints containing
wp_capabilities,wp_user_level, or similar privileged meta key names in the request body.
# Via WP-CLI: audit for mismatched registration date vs. admin role
wp user list --role=administrator --fields=ID,user_login,user_registered,roles --format=tableDefence-in-Depth
- Apply the principle of least privilege to any plugin that exposes user-meta-update functionality over REST — explicitly allow-list the meta keys a caller may modify rather than relying on a deny-list or no check at all.
- Enable two-factor authentication for all administrator accounts, so that even a successfully escalated account faces an additional barrier before full admin session access.
Key Takeaways
- CVE-2026-103694 lets any self-registered WordPress user escalate to administrator via an unrestricted REST user-meta update in Mobile builder through 1.4.2.
- The exploitation barrier is minimal — a free customer signup is all that's required.
- This plugin version also carries an unauthenticated SQL injection, CVE-2026-103695 — sites running Mobile builder face two independent critical issues simultaneously.
- No fix is available yet — deactivate the plugin or restrict self-registration until a patch ships.