rnlab Mobile builder WordPress plugin privilege escalation
Ordinary members of a WordPress app plugin can seize admin rights.
Summary
A logged-in member of the WordPress app builder plugin Mobile builder can overwrite their own account data and gain administrator rights. Versions up to and including 1.4.2 are affected.
Affected when
- A logged-in account (Subscriber or higher)
What to do
Check that the plugin runs a version newer than 1.4.2 and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen