CVE-2025-13029 Knowband Mobile App Builder for wooCommerce < 3.0.0 – Unauthenticated Arbitrary User Deletion
Unauthenticated attackers can delete arbitrary users via the REST API due to missing authorization checks in the Knowband Mobile App Builder plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-13029?
CVE-2025-13029 is a high-severity missing authorization vulnerability in Unknown Knowband Mobile App Builder, published on 31 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Knowband Mobile App Builder WordPress plugin before 3.0.0 does not have authorisation when deleting users via its REST API, allowing unauthenticated attackers to delete arbitrary users.
Which versions are affected by CVE-2025-13029?
How do I fix CVE-2025-13029?
No fix has been published for CVE-2025-13029 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-13029 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-13029 exists.
Sources
Also known as GHSA-4xqm-hx6r-2gp8.