High · published December 31, 2025
⚡ A simple API call could lead to chaos! The Knowband Mobile App Builder plugin for WordPress has a major flaw that lets unauthenticated attackers delete any user they want! 🔥 Think of it like a hotel front desk that allows anyone to check someone out without verifying their identity — one rogue guest could wipe out an entire list of reservations without breaking a sweat! If this vulnerability is exploited, attackers could delete user accounts with ease, leading to loss of data and trust. This is especially alarming for sites relying on user registrations and memberships, as it could disrupt services and leave users in the lurch.
Think of it like a hotel front desk that allows anyone to check someone out without verifying their identity — one rogue guest could wipe out an entire list of reservations without breaking a sweat! This vulnerability arises from a lack of authorization checks when deleting users via the REST API in the Knowband Mobile App Builder plugin. This means that anyone can send a request to delete users without needing to log in or prove their identity.
If this vulnerability is exploited, attackers could delete user accounts with ease, leading to loss of data and trust. This is especially alarming for sites relying on user registrations and memberships, as it could disrupt services and leave users in the lurch. To safeguard against this vulnerability, update the Knowband Mobile App Builder plugin to version 3.0.0 or newer. Additionally, audit your REST API configurations to ensure proper authorization mechanisms are in place for sensitive actions. 🛡️ You’ve got this! Take these steps to protect your site and its users! 🌟