The Mobile builder plugin for WordPress up to version 1.4.2 contains a privilege escalation vulnerability. This flaw arises from a PHP loose-comparison logic error in the meta key allow-list check combined with insufficient permission verification. Authenticated users with Subscriber-level access or higher can exploit this to overwrite user meta data, including wp_capabilities, thereby elevating their privileges to Administrator.