The Mobile Builder WordPress plugin up to version 1.4.2 fails to sanitize or escape the ‘delivery_id’ parameter before it is incorporated into a SQL query. This weakness allows any unauthenticated user to inject arbitrary SQL code, potentially retrieving, modifying, or deleting sensitive data from the database. The vulnerability is classified as a classic SQL injection (CWE‑89).

WordPress sites that have the Mobile Builder plugin version 1.4.2 or earlier installed and also run the WCFM Delivery add‑on are affected. The plugin’s vulnerability is tied to the presence of that add‑on, as the insecure SQL statement is only executed when the add‑on is active.

The CVSS score of 6.8 indicates medium severity. Because the flaw permits unauthenticated SQL injection, any attacker reaching the vulnerable endpoint can read or alter database contents. The EPSS score is below 1%, indicating a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Still, the lack of a public patch and the necessity of the WCFM Delivery add‑on on affected sites elevate the risk for those environments.