7.5
/ 10
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Description
The Knowband Mobile App Builder WordPress plugin before 3.0.0 does not have authorisation when deleting users via its REST API, allowing unauthenticated attackers to delete arbitrary users.
Basic Information
ID
CVE-2025-13029
Source
WPScan
Published
Dec 31, 2025 at 06:00
Modified
Jan 2, 2026 at 14:37
Affected Product
Vendor
Unknown
Product
Knowband Mobile App Builder
Affected Versions
Unknown Knowband Mobile App Builder 0