CVE-2026-61984
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
The WPMobile.App plugin versions up to 11.77 have a Broken Access Control vulnerability that can be exploited without authentication.
Risk Assessment
An attacker can access administrative functions or sensitive data, potentially leading to full system compromise.
Recommendation
Update the WPMobile.App plugin to the latest version that fixes this issue.
Other vulnerabilities in WPMobile.App
See all- CVE-2026-96342Medium
The WPMobile.App (wpappninja) plugin for WordPress contains a Missing Authorization vulnerability in versions up to and including 11.83. This allows retrieving embedded sensitive data.
- CVE-2026-94541Critical
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to exfiltrate password-reset URLs for arbitrary users, including administrators, mirrored into the push queue by the mail-to-push feature, and use those URLs to take over the targeted accounts.
- CVE-2026-112359High
The WPMobile.App plugin contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. Unauthorized parties may access functions or resources that should be protected.
Original NVD description (English source)
Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS