The Mobile builder WordPress plugin up to version 1.4.2 fails to enforce proper authorization on a REST API route that allows updating user meta keys. An attacker with a self‑registered account can use this route to alter the meta entry that designates the user role, effectively granting themselves administrator privileges.

WordPress sites that include the Mobile builder plugin version 1.4.2 or earlier are affected. No specific vendor beyond the plugin name is referenced, so any WordPress installation using these releases is at risk.

The vulnerability permits any authenticated user to elevate their privileges to administrator by manipulating a REST route that updates user meta keys. Because the route is publicly accessible to logged‑in users, an attacker only needs a self‑registered account to exploit it. The CVSS score of 8.8 indicates high severity, while the EPSS score of < 1 % suggests a low but nonzero exploitation probability. The vulnerability is not listed in CISA KEV, but the lack of access control and the ability to take full site control represent a serious risk. The attack vector is straightforward and does not require advanced skills or external network access.