PT-2025-54282 · WordPress · Mobile App Builder

Khaled Alenazi · CVE-2025-13029 · Published 2025-12-31 · Updated 2026-01-05

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Knowband Mobile App Builder WordPress plugin versions prior to 3.0.0

Description The plugin lacks proper authorization checks when deleting users through its REST API. This allows unauthenticated attackers to delete any user. The vulnerable API endpoint allows for arbitrary user deletion without authentication. The affected API endpoint is used for user management.

Recommendations Update to version 3.0.0 or later.

Exploit

Fix

Related Identifiers

CVE-2025-13029

Affected Products

Mobile App Builder

References · 6

• 🔥 https://wpscan.com/vulnerability/22344534-cd36-4817-b683-c0af55759e01 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-13029 · Security Note
• https://twitter.com/VulmonFeeds/status/2006289642266497158 · Twitter Post
• https://twitter.com/cracbot/status/2008131408699719821 · Twitter Post
• https://twitter.com/CVEnew/status/2006332208534168004 · Twitter Post
• https://t.me/cveNotify/147288 · Telegram Post