Mobile builder <= 1.4.2 - Authenticated (Subscriber+) Privilege Escalation to wcfm-profile-settings REST Route 'key'/'data' Parameters

Overview

The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the wcfmmp_profile_settings() REST handler exposed at POST /mobile-builder/v1/wcfm-profile-settings. This is due to a PHP loose-comparison logic flaw in the meta key allow-list check — strpos( $key, 'mobile_builder' ) == 0 evaluates to true for any key that does not contain the substring 'mobile_builder' because strpos() returns false on no match and false == 0 is true in PHP — combined with a permission_callback (user_permissions_check) that grants access to any authenticated user by only verifying $user->exists(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to pass an unsanitized data array via the key and data parameters directly to update_user_meta(), overwriting arbitrary user meta on their own account — including the wp_capabilities meta key — to grant themselves Administrator-level privileges.

Affected

• mobile_builder <= 1.4.2

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.