The vulnerability lies in an authorization bypass that allows anyone to obtain password‑reset URLs for any user, including administrators. By tricking the plugin into placing these URLs into the push queue, an attacker can use them to log into privileged accounts without authenticating later. This flaw enables complete compromise of WordPress sites that rely on the plugin for mobile app generation.

WordPress sites that have the WPMobile.App – Android and iOS App Builder plugin installed, any version up to and including 11.82.

The flaw scores a CVSS of 9.8, indicating critical severity. The EPSS score is unavailable, but the absence of a KEV listing does not reduce the risk; the impact remains high. Exploitation requires merely enabling the plugin’s mail‑to‑push feature (wpmobile_auto_mail=1) so that password‑reset emails are mirrored to the push queue. Based on the description, it is inferred that the attack can be launched via an online request to the plugin’s API endpoint that triggers the mail‑to‑push feature, thus the likely attack vector is remote. An attacker can trigger this remotely and retrieve administrator reset links with ease, making the attack vector effectively online or remote network exposure.