{"schema":"vulnpedia.research/1","cve":"CVE-2026-94541","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18fddc88-53d5-42c0-946f-f88ef6abb39f?source=cve","tags":[],"source":"mitre","sourceId":"Wordfence","modified":"2026-10-02T09:25:55.662Z","origins":[{"source":"mitre","sourceId":"Wordfence","modified":"2026-10-02T09:25:55.662Z","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18fddc88-53d5-42c0-946f-f88ef6abb39f?source=cve"},{"source":"nvd","sourceId":"CVE-2026-94541","modified":"2026-10-02T18:17:07.870","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18fddc88-53d5-42c0-946f-f88ef6abb39f?source=cve"}]},{"url":"https://plugins.trac.wordpress.org/browser/wpappninja/trunk/inc/functions/sdk2019.php#L256","tags":[],"source":"mitre","sourceId":"Wordfence","modified":"2026-10-02T09:25:55.662Z","origins":[{"source":"mitre","sourceId":"Wordfence","modified":"2026-10-02T09:25:55.662Z","url":"https://plugins.trac.wordpress.org/browser/wpappninja/trunk/inc/functions/sdk2019.php#L256"},{"source":"nvd","sourceId":"CVE-2026-94541","modified":"2026-10-02T18:17:07.870","url":"https://plugins.trac.wordpress.org/browser/wpappninja/trunk/inc/functions/sdk2019.php#L256"}]},{"url":"https://plugins.trac.wordpress.org/browser/wpappninja/trunk/inc/api/read_enhanced.php#L171","tags":[],"source":"mitre","sourceId":"Wordfence","modified":"2026-10-02T09:25:55.662Z","origins":[{"source":"mitre","sourceId":"Wordfence","modified":"2026-10-02T09:25:55.662Z","url":"https://plugins.trac.wordpress.org/browser/wpappninja/trunk/inc/api/read_enhanced.php#L171"},{"source":"nvd","sourceId":"CVE-2026-94541","modified":"2026-10-02T18:17:07.870","url":"https://plugins.trac.wordpress.org/browser/wpappninja/trunk/inc/api/read_enhanced.php#L171"}]},{"url":"https://plugins.trac.wordpress.org/browser/wpappninja/trunk/inc/common/deeplinking.php#L249","tags":[],"source":"mitre","sourceId":"Wordfence","modified":"2026-10-02T09:25:55.662Z","origins":[{"source":"mitre","sourceId":"Wordfence","modified":"2026-10-02T09:25:55.662Z","url":"https://plugins.trac.wordpress.org/browser/wpappninja/trunk/inc/common/deeplinking.php#L249"},{"source":"nvd","sourceId":"CVE-2026-94541","modified":"2026-10-02T18:17:07.870","url":"https://plugins.trac.wordpress.org/browser/wpappninja/trunk/inc/common/deeplinking.php#L249"}]},{"url":"https://plugins.trac.wordpress.org/browser/wpappninja/trunk/inc/api/push.php#L467","tags":[],"source":"mitre","sourceId":"Wordfence","modified":"2026-10-02T09:25:55.662Z","origins":[{"source":"mitre","sourceId":"Wordfence","modified":"2026-10-02T09:25:55.662Z","url":"https://plugins.trac.wordpress.org/browser/wpappninja/trunk/inc/api/push.php#L467"},{"source":"nvd","sourceId":"CVE-2026-94541","modified":"2026-10-02T18:17:07.870","url":"https://plugins.trac.wordpress.org/browser/wpappninja/trunk/inc/api/push.php#L467"}]},{"source":"euvd","sourceId":"EUVD-2026-91334","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-91334","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-91334","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-91334"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-94541","modified":"2026-10-02T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-94541","modified":"2026-10-02T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://patchstack.com/database/wordpress/plugin/wpappninja/vulnerability/wordpress-wpmobile-app-plugin-11-82-unauthenticated-admin-account-takeover-via-wpapp-category-parameter-vulnerability","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-94541","modified":"2026-10-02T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-94541","modified":"2026-10-02T00:00:00Z","url":"https://patchstack.com/database/wordpress/plugin/wpappninja/vulnerability/wordpress-wpmobile-app-plugin-11-82-unauthenticated-admin-account-takeover-via-wpapp-category-parameter-vulnerability"}]},{"url":"https://vulncheck.com/xdb/293bc7e0f222","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"293bc7e0f222","modified":"2026-10-02T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"293bc7e0f222","modified":"2026-10-02T00:00:00Z","url":"https://vulncheck.com/xdb/293bc7e0f222"}]},{"url":"https://github.com/anoxhunterdump-ctrl/CVE-2026-94541-WPMobileApp-AuthBypass","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"293bc7e0f222","modified":"2026-10-02T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"293bc7e0f222","modified":"2026-10-02T00:00:00Z","url":"https://github.com/anoxhunterdump-ctrl/CVE-2026-94541-WPMobileApp-AuthBypass"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/anoxhunterdump-ctrl/CVE-2026-94541-WPMobileApp-AuthBypass","source":"poc-in-github","sourceId":"CVE-2026-94541","description":"Defensive analysis, detection scanner, and rule signatures for CVE-2026-94541 (WPMobile.App <= 11.82).","modified":"2026-10-02T17:26:44Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-94541","url":"https://github.com/anoxhunterdump-ctrl/CVE-2026-94541-WPMobileApp-AuthBypass"},{"source":"poc-in-github","sourceId":"CVE-2026-94541","modified":"2026-10-02T17:26:44Z","url":"https://github.com/anoxhunterdump-ctrl/CVE-2026-94541-WPMobileApp-AuthBypass"}],"tags":[]}],"cataloguedPoc":[{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"293bc7e0f222","url":"https://vulncheck.com/xdb/293bc7e0f222","cve":"CVE-2026-94541","dateAdded":"2026-10-02T11:04:32Z","modified":"2026-10-02T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/anoxhunterdump-ctrl/CVE-2026-94541-WPMobileApp-AuthBypass","observations":[{"dateAdded":"2026-10-02T11:04:32Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"293bc7e0f222","modified":"2026-10-02T00:00:00Z","url":"https://vulncheck.com/xdb/293bc7e0f222"}]}],"vendorStatements":[],"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2026-94541","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-10-02T00:00:00Z","modified":"2026-10-02T00:00:00Z","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown","reportedByVulncheckCanaries":false,"vendorProject":"amauric","product":"WPMobile.App – Android and iOS App Builder","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-94541","modified":"2026-10-02T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-94541","catalog":"VulnCheck KEV","kind":"report","url":"https://patchstack.com/database/wordpress/plugin/wpappninja/vulnerability/wordpress-wpmobile-app-plugin-11-82-unauthenticated-admin-account-takeover-via-wpapp-category-parameter-vulnerability","dateAdded":"2026-10-02T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-94541","url":"https://patchstack.com/database/wordpress/plugin/wpappninja/vulnerability/wordpress-wpmobile-app-plugin-11-82-unauthenticated-admin-account-takeover-via-wpapp-category-parameter-vulnerability"}]}]}