Overview
A critical, unauthenticated SQL injection vulnerability, tracked as CVE-2026-103695, has been disclosed in Mobile builder, a WordPress plugin used to generate native mobile apps for WooCommerce-powered sites. The plugin, through version 1.4.2, does not sanitize or escape the vendor_id parameter before using it in a SQL statement — documented as "Mobile Builder ≤ 1.4.2 – Unauthenticated SQLi via vendor_id Parameter" — allowing any unauthenticated attacker to inject arbitrary SQL.
This is a second, independent critical flaw in the same plugin version alongside CVE-2026-103694, a privilege-escalation issue — sites running Mobile builder ≤ 1.4.2 face two separate paths to full compromise.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-103695 |
| CWE | CWE-89 — SQL Injection |
| Attack Vector | Network |
| Authentication | None Required |
| Privileges Required | None |
| User Interaction | None |
| Vulnerable Parameter | vendor_id |
| Affected Versions | Mobile builder through 1.4.2 |
| Fixed Version | Not published at time of writing — see Mitigation |
| Assigner | WPScan |
| Companion CVE | CVE-2026-103694 — privilege escalation in the same plugin version |
How It Works
Mobile builder's vendor-lookup functionality accepts a vendor_id value and uses it to build a SQL query. The developers never routed that parameter through $wpdb->prepare() or an equivalent parameterized-query mechanism — instead, the raw, attacker-supplied value is concatenated directly into the query string.
Because this endpoint requires no authentication at all, any remote attacker can submit a crafted vendor_id containing SQL metacharacters and manipulate the resulting query — extracting database contents (customer records, vendor data, credentials) through classic SQL injection techniques, or potentially chaining into write access depending on the database account's permissions.
Impact Assessment
| Impact Area | Description |
|---|---|
| Confidentiality | High — the full WordPress/WooCommerce database, including customer and vendor records, is exposed |
| Integrity | High — depending on database privileges, injection primitives can sometimes be escalated to writes |
| Availability | Medium — resource-intensive injected queries can degrade database performance |
| Authentication Required | None — this is a zero-privilege, remotely exploitable flaw |
Who Is At Risk
- Any WooCommerce storefront running Mobile builder through 1.4.2 with the vendor-lookup functionality (used by multi-vendor marketplace setups) reachable from the public internet
- Multi-vendor marketplaces specifically, since the
vendor_idparameter implies vendor-related data — potentially including vendor payout or account details — sits directly behind the vulnerable query
Mitigation
Immediate Actions
- No patched release has been published as of this writing. Until one lands, consider deactivating Mobile builder or restricting access to the vendor-lookup endpoint at the web server or WAF layer.
- Deploy a WAF rule to detect and block common SQL injection payloads (
' OR,UNION SELECT, stacked-query separators) in requests carrying avendor_idparameter. - Restrict the database account used by WordPress to the minimum privileges required for normal site operation, limiting the blast radius if injection succeeds.
Detection Opportunities
- Review web server and database logs for requests to Mobile builder's vendor-lookup endpoint with SQL metacharacters in the
vendor_idvalue. - Watch for anomalously slow responses or elevated database load correlated with requests carrying unusual
vendor_idvalues, consistent with time-based blind injection attempts.
Defence-in-Depth
- Audit all other parameters handled by Mobile builder for the same missing-parameterization pattern, since a plugin that mishandles one SQL input often mishandles others.
- Given two independent critical CVEs disclosed simultaneously in this plugin version, teams with strict risk tolerances should weigh migrating away from Mobile builder until both are fixed upstream.
Key Takeaways
- CVE-2026-103695 is an unauthenticated SQL injection via the
vendor_idparameter in Mobile builder through 1.4.2. - No authentication or user interaction is required — this is directly, remotely exploitable.
- The same plugin version also carries CVE-2026-103694, an unrelated privilege-escalation flaw — treat both as active risks.
- No fix is available yet — restrict or disable the affected functionality until a patch ships.