The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including,…

The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the wcfmmp_profile_settings() REST handler exposed at POST /mobile-builder/v1/wcfm-profile-settings. This is due to a PHP loose-comparison logic flaw in the meta key allow-list check — strpos( $key, 'mobile_builder' ) == 0 evaluates to true for any key that does *not* contain the substring 'mobile_builder' because strpos() returns false on no match and false == 0 is true in PHP — combined with a permission_callback (user_permissions_check) that grants access to any authenticated user by only verifying $user->exists(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to pass an unsanitized data array via the key and data parameters directly to update_user_meta(), overwriting arbitrary user meta on their own account — including the wp_capabilities meta key — to grant themselves Administrator-level privileges.