CVE-2026-103696 Overview
CVE-2026-103696 is a SQL injection vulnerability in the Mobile Builder WordPress plugin through version 1.4.2. The plugin fails to sanitize and escape a user-supplied parameter before passing it to a SQL statement. Unauthenticated attackers can inject arbitrary SQL on sites that also run the WCFM Delivery add-on. The flaw is tracked under CWE-89 and was published in the WPScan vulnerability database. Exploitation requires the companion add-on to be active, which raises attack complexity but does not require authentication or user interaction.
Critical Impact
Unauthenticated attackers can extract sensitive database contents, including user credentials and personal data stored by WordPress and WooCommerce.
Affected Products
- Mobile Builder WordPress plugin, all versions through 1.4.2
- WordPress sites running the WCFM Delivery add-on as a prerequisite
- WooCommerce multi-vendor environments using Mobile Builder for app integration
Discovery Timeline
- 2026-10-16 - CVE-2026-103696 published to NVD
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-103696
Vulnerability Analysis
The Mobile Builder plugin exposes an endpoint that accepts a parameter used directly inside a SQL query. The code path does not apply WordPress sanitization helpers such as esc_sql(), nor does it use parameterized queries through $wpdb->prepare(). An attacker can inject SQL syntax into the vulnerable parameter and alter query semantics.
The vulnerability only triggers when the WCFM Delivery add-on is installed, since the query references schema introduced by that integration. This dependency explains the high attack complexity classification. The scope change in the CVSS vector reflects that injected SQL can access data belonging to multiple WordPress components beyond the plugin itself.
Successful exploitation enables data exfiltration from the WordPress database, including the wp_users table containing password hashes, session tokens, and customer records stored by WooCommerce.
Root Cause
The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The plugin concatenates untrusted input into a SQL string instead of binding it as a parameter. WordPress provides $wpdb->prepare() specifically to prevent this class of flaw, but the vulnerable code path bypasses it.
Attack Vector
The attack is executed over the network against the WordPress HTTP endpoint registered by Mobile Builder. No authentication is required. An attacker sends a crafted request containing SQL metacharacters in the vulnerable parameter. The server executes the injected query against the WordPress MySQL or MariaDB backend and returns data influenced by the attacker payload.
Technical details are available in the WPScan Vulnerability Advisory.
Detection Methods for CVE-2026-103696
Indicators of Compromise
- Web server access logs containing SQL metacharacters such as UNION SELECT, SLEEP(, --, or 0x encoded payloads targeting Mobile Builder endpoints
- Unexpected database queries referencing wp_users, wp_usermeta, or WCFM Delivery tables from the plugin context
- Elevated response times on Mobile Builder endpoints consistent with time-based blind SQL injection
- New or modified administrator accounts in wp_users without a corresponding audit trail
Detection Strategies
- Deploy a web application firewall ruleset that inspects requests to Mobile Builder plugin routes for SQL injection patterns
- Enable WordPress query logging or MySQL general query log in staging to baseline normal plugin queries, then alert on deviations
- Review WPScan or equivalent vulnerability scanner output for installations of Mobile Builder <= 1.4.2 alongside WCFM Delivery
Monitoring Recommendations
- Monitor outbound traffic from the web host for signs of database exfiltration to unknown destinations
- Alert on anomalous SELECT query volume originating from the WordPress PHP worker process
- Track plugin version inventory across WordPress fleets and flag hosts running vulnerable Mobile Builder releases
How to Mitigate CVE-2026-103696
Immediate Actions Required
- Deactivate the Mobile Builder plugin on any site that also runs the WCFM Delivery add-on until a patched release is confirmed
- Place a WAF rule in front of WordPress that blocks SQL injection payloads on Mobile Builder endpoints
- Audit wp_users and wp_options for unauthorized administrator accounts and rotate all WordPress and database credentials if tampering is suspected
- Review web server access logs for the past 90 days for exploitation attempts matching the indicators above
Patch Information
At the time of publication, the WPScan advisory lists all versions through 1.4.2 as vulnerable. No fixed version is referenced in the NVD entry. Site operators should monitor the WPScan Vulnerability Advisory and the plugin vendor's changelog for a patched release and apply it as soon as it becomes available.
Workarounds
- Remove the WCFM Delivery add-on if it is not business critical, which breaks the exploitation prerequisite
- Restrict access to the WordPress admin and REST API endpoints by IP allowlist where feasible
- Enforce database least privilege so the WordPress MySQL user cannot read tables outside the WordPress schema
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
