CVE-2026-103696
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement. This allows unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on.
Risk Assessment
An unauthenticated attacker can execute arbitrary SQL queries, potentially leading to leakage, modification, or deletion of data from the site's database.
Recommendation
Update the Mobile builder plugin to a version later than 1.4.2 when available. Until then, consider disabling the plugin or the WCFM Delivery add-on.
Other vulnerabilities in Mobile builder WordPress plugin
See all- CVE-2026-103695High
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement. This allows unauthenticated users to perform SQL injection attacks.
- CVE-2026-103694High
The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes. This allows any user with a self-registered account, such as a customer, to grant themselves the administrator role.
Original NVD description (English source)
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS