The Mobile builder plugin for WordPress contains a flaw in the REST handler for the wcfm-profile-settings route. A loose comparison in the meta key allow‑list – strpos($key,'mobile_builder')==0 – returns true for any key that does not include the string 'mobile_builder', because strpos returns false on a miss and false==0 is true in PHP. Combined with a permission callback that only checks that the user exists, any authenticated user can reach the endpoint and supply arbitrary key/value pairs in the data payload. These pairs are passed directly to update_user_meta(), allowing a logged‑in user to overwrite their own user meta, including the wp_capabilities meta key, thereby elevating themselves to Administrator level. This represents a clear privilege escalation that can compromise the entire WordPress site.

WordPress installations that have the RNLab Mobile builder plugin installed, with any version up to and including 1.4.2. Sites using earlier or later releases are not impacted.

The CVSS score of 8.8 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the authenticated REST API endpoint POST /mobile-builder/v1/wcfm-profile-settings, which requires only standard WordPress login credentials. Because any logged‑in user can trigger the endpoint and supply arbitrary meta data, the likelihood of exploitation is high unless the plugin is updated or the endpoint is otherwise restricted.