The Mobile Builder WordPress plugin, versions up to 1.4.2, fails to sanitize the 'vendor_id' parameter before incorporating it into a SQL query. This flaw allows attackers to inject arbitrary SQL statements without any authentication, potentially reading, modifying, or deleting data in the plugin’s database. Such unauthorized actions could lead to data exfiltration, integrity loss, or full compromise of the WordPress site if the database hosts executable content or sensitive credentials.

Any WordPress installation that has the Mobile Builder plugin 1.4.2 or an earlier release deployed is affected, regardless of theme or other plugins. The vulnerability resides directly in the plugin’s database handling code, so the issue is present on all sites running those versions.

Exploit requires only an unauthenticated HTTP request containing a crafted 'vendor_id' value, so the barrier to attack is very low. The EPSS score is less than 1 percent, and the vulnerability is not listed in CISA’s KEV catalog, yet the lack of input validation combined with unrestricted access makes the risk significant. Attackers could retrieve sensitive information or alter database records, potentially enabling further malicious activities such as credential theft, site defacement, or a pivot into the broader web application.