CVE-2026-103695: Mobile Builder WordPress SQL Injection

CVE-2026-103695 Overview

CVE-2026-103695 is a SQL injection vulnerability in the Mobile Builder WordPress plugin through version 1.4.2. The plugin fails to sanitize and escape a user-controlled parameter before incorporating it into a SQL statement. Unauthenticated attackers can exploit this flaw remotely over the network without any user interaction. Successful exploitation allows attackers to extract sensitive database contents, including WordPress user credentials and session data. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated attackers can inject arbitrary SQL queries into vulnerable WordPress sites running Mobile Builder plugin versions through 1.4.2, exposing database contents without authentication.

Affected Products

Mobile Builder WordPress plugin versions through 1.4.2
WordPress installations with the plugin activated
Sites exposing the vulnerable plugin endpoint to the internet

Discovery Timeline

2026-10-11 - CVE-2026-103695 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-103695

Vulnerability Analysis

The Mobile Builder plugin accepts a request parameter and passes it directly into a SQL query without applying input sanitization or parameter escaping. WordPress provides $wpdb->prepare() and esc_sql() functions specifically to prevent this class of flaw, neither of which the vulnerable code path uses. The flaw is reachable without authentication, meaning any remote visitor can send crafted requests to the plugin endpoint.

Attackers can leverage standard SQL injection techniques including UNION-based extraction, boolean-based blind injection, and time-based blind injection. Successful exploitation enables enumeration of the wp_users table, extraction of password hashes, and recovery of session tokens stored in wp_usermeta. The scope-changed CVSS metric indicates the vulnerability can affect resources beyond the vulnerable component, consistent with database compromise impacting the broader WordPress site.

Root Cause

The root cause is missing input validation on a parameter consumed by a SQL query. Developer-constructed SQL concatenation without parameterized queries directly embeds attacker-controlled data into the query string. This pattern bypasses WordPress's built-in query abstraction layer protections.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends an HTTP request to the vulnerable Mobile Builder endpoint with malicious SQL payloads in the affected parameter. No authentication, user interaction, or elevated privileges are needed. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-103695

Indicators of Compromise

HTTP requests to Mobile Builder plugin endpoints containing SQL metacharacters such as UNION, SELECT, --, /*, ' OR 1=1, or SLEEP(
Unusual outbound database queries targeting wp_users, wp_usermeta, or wp_options tables
Web server access logs showing repeated requests with URL-encoded SQL syntax from a single source
Unexpected creation of WordPress administrator accounts or modified user capabilities

Detection Strategies

Deploy web application firewall rules that identify SQL injection payloads targeting WordPress plugin parameters
Monitor MySQL query logs for anomalous UNION SELECT statements or queries referencing information_schema
Alert on HTTP 500 errors or long response times from plugin endpoints, indicating blind injection probing

Monitoring Recommendations

Enable WordPress audit logging for user account creation, role changes, and plugin configuration modifications
Correlate web server logs with database query logs to identify payload-to-query mappings
Baseline normal plugin traffic patterns and alert on parameter value anomalies

How to Mitigate CVE-2026-103695

Immediate Actions Required

Deactivate the Mobile Builder plugin until a patched version is confirmed available from the vendor
Review WordPress user accounts for unauthorized administrator additions and reset all administrative credentials
Rotate WordPress authentication keys and salts defined in wp-config.php to invalidate stolen session tokens
Restrict access to the WordPress site using IP allowlists or authentication proxies while remediation is pending

Patch Information

At the time of publication, no patched version beyond 1.4.2 is referenced in the available advisory. Monitor the WPScan Vulnerability Report for updated vendor remediation guidance.

Workarounds

Block requests to Mobile Builder plugin endpoints at the web application firewall layer
Apply virtual patching rules that reject HTTP parameters containing SQL metacharacters
Restrict database user privileges for the WordPress MySQL account to minimum required operations

bash

# Example ModSecurity rule to block SQL injection patterns on plugin endpoints
SecRule REQUEST_URI "@contains /wp-content/plugins/mobile-builder/" \
    "id:1026103695,phase:2,deny,status:403,\
    msg:'Blocked potential SQL injection against Mobile Builder plugin',\
    chain"
    SecRule ARGS "@detectSQLi" "t:none,t:urlDecode,t:lowercase"