CVE-2026-103695
Received Received - Intake

SQL Injection in Mobile Builder WordPress Plugin

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: WPScan

Description
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-103695
EUVD
EUVD-2026-96737

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Mobile builder 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Mobile builder WordPress plugin through version 1.4.2 has a vulnerability where it does not properly sanitize and escape the 'vendor_id' parameter before using it in SQL queries. This allows unauthenticated users to inject malicious SQL code, potentially accessing or manipulating the database.

Detection Guidance

To detect this vulnerability, check if the Mobile Builder WordPress plugin version 1.4.2 or earlier is installed. Look for unauthenticated SQL injection attempts targeting the 'vendor_id' parameter in HTTP requests. Monitor database logs for unusual queries or errors.

Impact Analysis

This vulnerability allows attackers to execute arbitrary SQL commands without authentication. This could lead to unauthorized data access, data deletion, or modification of database contents, potentially compromising sensitive information stored in the WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of personal data, which may violate GDPR, HIPAA, or other privacy regulations. Compliance issues may arise if sensitive data is compromised due to the SQL injection flaw.

Mitigation Strategies

Immediately update the Mobile Builder plugin to the latest version if available. If no update exists, consider disabling or removing the plugin until a patch is released. Implement web application firewall rules to block SQL injection attempts targeting the 'vendor_id' parameter.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103695. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart