Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

WPMobile.App lets outsiders hijack admin accounts

CVE-2026-94541 · published 17 days ago
Summary

The WPMobile.App plugin for WordPress sites can be tricked into giving password‑reset links to anyone when its mail‑to‑push feature is turned on. An attacker can use those links to take over any user’s account, including the site administrator. Disable the mail‑to‑push setting or update the plugin to a version that fixes the check.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
amauric wpmobile.app – android and ios app builder <= 11.82
Original advisory text
WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to exfiltrate password-reset URLs for arbitrary users, including administrators, mirrored into the push queue by the mail-to-push feature, and use those URLs to take over the targeted accounts. This exploit chain requires the plugin's mail-to-push feature (wpmobile_auto_mail=1) to be enabled, as that setting is what causes outbound WordPress password-reset emails — including the reset URL and key — to be mirrored into the push row queue where they become accessible to the attacker.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published2 Oct 2026
Updated15 Oct 2026
First seen2 Oct 2026
Sources
CVE-2026-94541 · NVD
CVE-2026-94541 · MITRE
Track software like this
Free during beta