External risk intelligence

Mobile Builder Authentication Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-68860

This vulnerability affects a WordPress plugin. WordPress plugins are commonly deployed as part of public-facing web applications, making the attack surface reachable from the internet in typical deployments.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical authentication bypass vulnerability in Mobile Builder, a tool used for creating mobile applications. The flaw allows unauthorized access to the system, potentially impacting the integrity and confidentiality of data. The main concern at this time is to confirm whether this specific technology is in use within our environment and assess any potential exposure.

Bypasses user login for unauthorized access.
Critical flaw impacts application security.
Verify usage and exposure within our systems.

Attack Path

How an attacker could exploit the issue

An attacker could bypass authentication by exploiting a weakness in how the Mobile Builder handles requests, potentially through a different channel or path than intended. This could allow them to abuse authentication mechanisms, leading to unauthorized access and control over the application's features.

No specific authentication required.
Triggered via an alternate path or channel.
Allows unauthorized access and control.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to bypass authentication controls in Mobile Builder. This could potentially lead to unauthorized access and manipulation of the service.

Access to service functionality and settings.
Via network with no privileges.
Unauthorized access to service functions.

Operational Fix

Recommended remediation, mitigation, and detection steps

This authentication bypass vulnerability in Mobile Builder requires action from teams managing web applications, likely application owners, platform administrators, and potentially network security teams to assess exposure. The first practical step is to identify all instances of the affected Mobile Builder plugin, determine their accessibility from external networks, and then prioritize remediation based on business criticality and potential impact.

Application owners and platform teams.
Verify Mobile Builder plugin instances and reachability.
Plan remediation based on exposure and business impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Mobile Builder plugin used for?

Mobile Builder is a WordPress plugin designed to help site administrators create and manage mobile versions of their websites. It acts as a bridge between a standard WordPress installation and a mobile application interface, allowing users to extend their site's functionality to mobile platforms.

What does Authentication Bypass Using an Alternate Path or Channel mean for CVE-2025-68860?

This weakness, classified as CWE-288, means the software performs authentication checks incorrectly by relying on a flawed path or communication channel. Instead of verifying a user's identity through standard login procedures, the system may accept credentials or requests sent through an unintended route, allowing attackers to skip login security entirely.

How is this vulnerability triggered in Mobile Builder?

An attacker triggers this by sending specific network requests that exploit the plugin's flawed authentication logic. It does not require any existing user account or prior privileges. Note that simply visiting the website or interacting with standard, properly secured parts of the WordPress site will not trigger this bug; it specifically targets the vulnerable request path used by the plugin.

Is my site at risk from this vulnerability?

If you are using Mobile Builder versions 1.4.2 or earlier, your system is affected. According to Halo Surface Signal, because this is a WordPress plugin typically installed on public-facing websites, the attack surface is often directly reachable from the internet. You should assume the vulnerability is accessible unless your specific deployment uses strict network-level blocks.

What steps should I take to respond to this threat?

Begin by auditing your WordPress environment to identify if the Mobile Builder plugin is installed and check its current version number. If version 1.4.2 or lower is present, treat the plugin as a potential entry point. Consult the plugin developer for available updates or security patches, and remove the plugin if it is not essential to your current operations.

References

patchstack.com/database/Wordpress/Plugin/mobile-builder/vulnerabilit…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.