{"id":"CVE-2026-103694","aliases":["EUVD-2026-96736","GHSA-jm9q-87xx-cg6m"],"status":"published","title":"Mobile builder \u003c= 1.4.2 - Subscriber+ Privilege Escalation to Admin","description":"The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00278,"percentile":0.20459,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2026-10-11T06:00:08Z","modified":"2026-10-13T20:36:00Z","products":[{"vendor":"mobile builder","product":"mobile builder"},{"vendor":"unknown","product":"mobile builder"}],"references":[{"url":"https://wpscan.com/vulnerability/5d087920-26f3-4c71-bfcb-ae9a70cc407f/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103694"},{"url":"https://wpscan.com/vulnerability/5d087920-26f3-4c71-bfcb-ae9a70cc407f"},{"url":"https://github.com/advisories/GHSA-jm9q-87xx-cg6m"}],"sources":{"cve":[{"id":"CVE-2026-103694","title":"Mobile builder \u003c= 1.4.2 - Subscriber+ Privilege Escalation to Admin","description":"The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role.","status":"published","published":"2026-10-11T06:00:08.579Z","modified":"2026-10-11T11:42:53.633Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T13:34:48.658051Z"}],"euvd":[{"id":"EUVD-2026-96736","description":"The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role.","status":"published","published":"2026-10-11T06:00:08Z","modified":"2026-10-11T11:42:53Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:23.217739Z"}],"ghsa":[{"id":"GHSA-jm9q-87xx-cg6m","title":"The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys...","description":"The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role.","status":"published","published":"2026-10-11T09:30:23Z","modified":"2026-10-11T12:31:06Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:13:03.923045Z"}],"nvd":[{"id":"CVE-2026-103694","description":"The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role.","status":"published","published":"2026-10-11T07:17:22.23Z","modified":"2026-10-13T20:36:00.85Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:12:55.874869Z"}]}}