CVE-2026-96342: WPMobile.App Information Disclosure Flaw

CVE-2026-96342 Overview

CVE-2026-96342 is a Missing Authorization vulnerability [CWE-862] in the Amauri.IO WPMobile.App (wpappninja) WordPress plugin. The flaw allows unauthenticated attackers to retrieve embedded sensitive data from affected installations. All versions of WPMobile.App up to and including 11.83 are impacted. The vulnerability is exploitable over the network without user interaction or prior authentication. Exposure is limited to information disclosure, with no direct impact on integrity or availability. Site operators running the plugin should treat exposed configuration or embedded credentials as compromised until rotated.

Critical Impact
Unauthenticated remote attackers can retrieve sensitive data embedded in the plugin, enabling secondary attacks against the WordPress site and its mobile app integrations.

Affected Products

Amauri.IO WPMobile.App (wpappninja) WordPress plugin
All versions from initial release through 11.83
WordPress sites exposing the plugin endpoints to the public internet

Discovery Timeline

2026-09-30 - CVE-2026-96342 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-96342

Vulnerability Analysis

The WPMobile.App plugin exposes functionality that returns sensitive data embedded within the plugin or associated configuration. The affected endpoints do not enforce an authorization check before returning the response. Any unauthenticated client capable of reaching the WordPress site can invoke the endpoint and receive the data.

Because the flaw is categorized as Missing Authorization [CWE-862] and the vendor description references retrieval of embedded sensitive data, the exposed material likely includes plugin secrets, tokens, or configuration values used to bridge the WordPress site with its companion mobile application. Attackers can leverage disclosed values to impersonate the mobile app, forge API requests, or pivot into administrative workflows.

Root Cause

The root cause is the absence of a capability check on plugin request handlers. WordPress plugins are expected to gate privileged operations behind current_user_can() checks, nonce validation via check_ajax_referer(), or REST route permission_callback functions. WPMobile.App through 11.83 omits these controls on the affected handler, allowing any caller to read the response.

Attack Vector

Exploitation is network-based and does not require credentials or user interaction. An attacker sends a crafted HTTP request to the vulnerable endpoint exposed by the plugin. The server processes the request without evaluating the caller's identity or capabilities and returns the embedded sensitive data. Refer to the Patchstack advisory for endpoint-level technical details.

Detection Methods for CVE-2026-96342

Indicators of Compromise

Unauthenticated HTTP requests to WPMobile.App plugin endpoints under /wp-admin/admin-ajax.php or /wp-json/ routes registered by wpappninja.
HTTP 200 responses containing configuration keys, tokens, or credential fields returned to unauthenticated clients.
Repeated requests from a single source enumerating plugin action parameters tied to the wpappninja handler.

Detection Strategies

Inspect web server access logs for requests referencing wpappninja action names or REST namespaces without a valid authenticated session cookie.
Correlate outbound activity from mobile-app API integrations with anomalous request sources that were not previously seen.
Deploy a web application firewall rule to flag unauthenticated access attempts to plugin endpoints that historically served authenticated traffic.

Monitoring Recommendations

Alert on any use of credentials or tokens sourced from the plugin outside of expected mobile-app IP ranges.
Monitor WordPress audit logs for administrative changes made shortly after suspicious plugin endpoint access.
Track plugin version inventory across managed WordPress sites and generate alerts when wpappninja remains at 11.83 or earlier.

How to Mitigate CVE-2026-96342

Immediate Actions Required

Update WPMobile.App to a version later than 11.83 once released by the vendor.
Rotate any API keys, tokens, or secrets embedded in the plugin configuration that may have been exposed.
Restrict access to plugin endpoints via WAF or reverse-proxy rules until a patch is applied.

Patch Information

Refer to the Patchstack advisory for WPMobile.App for vendor patch status and fixed version guidance. At publication, the advisory identifies versions through 11.83 as affected.

Workarounds

Disable the WPMobile.App plugin if the mobile application is not actively used.
Deploy WAF rules that block unauthenticated requests to wpappninja-registered AJAX actions and REST routes.
Restrict plugin endpoints to known mobile-app source IP ranges through server-level access controls.

bash

# Example nginx rule to block unauthenticated access to wpappninja AJAX actions
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^wpappninja_") {
        return 403;
    }
}