CVE-2026-94541 WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter
Unauthenticated attackers can take over admin accounts by exploiting an authorization bypass in the mail-to-push feature to steal password reset URLs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-94541?
CVE-2026-94541 is a critical authentication bypass vulnerability in amauric WPMobile.App – Android and iOS App Builder, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to exfiltrate password-reset URLs for arbitrary users, including administrators, mirrored into the push queue by the mail-to-push feature, and use those URLs to take over the targeted accounts. This exploit chain requires the plugin's mail-to-push feature (wpmobile_auto_mail=1) to be enabled, as that setting is what causes outbound WordPress password-reset emails — including the reset URL and key — to be mirrored into the push row queue where they become accessible to the attacker.
Weakness: CWE-862
Which versions are affected by CVE-2026-94541?
How do I fix CVE-2026-94541?
No fix has been published for CVE-2026-94541 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-94541 being exploited?
There is no known exploitation of CVE-2026-94541 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-qhj3-2w8c-62vm.