{"metadata": {"vulnerability": "cve-2026-94541", "count": 23, "kinds": {"milestone": 4, "sighting": 7, "kev": 0, "other": 12}}, "data": [{"timestamp": "2026-09-21T18:50:05.897Z", "date_only": false, "value": "2026-09-21T18:50:05.897Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-94541", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-21T20:13:11Z", "date_only": false, "value": "2026-09-21T20:13:11.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "cve-2026-94541", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-01T21:14:53Z", "date_only": false, "value": "2026-10-01T21:14:53.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "cve-2026-94541", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-02T09:25:55.662Z", "date_only": false, "value": "2026-10-02T09:25:55.662Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-94541", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-02T09:25:55.662Z", "date_only": false, "value": "2026-10-02T09:25:55.662Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "cve-2026-94541", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-02T10:17:09Z", "date_only": false, "value": "2026-10-02T10:17:09Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-QHJ3-2W8C-62VM", "record": "GHSA-QHJ3-2W8C-62VM", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-02T10:17:09.313Z", "date_only": false, "value": "2026-10-02T10:17:09.313", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94541", "record": "FKIE_CVE-2026-94541", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-02T10:30:24.717Z", "date_only": false, "value": "2026-10-02T10:30:24.717601Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117370848802242230", "record": "cve-2026-94541", "field": "creation_timestamp", "uuid": "253360a9-cb31-4f35-a1a2-e0a34bff3e3b", "content": "CVE-2026-94541: CRITICAL auth bypass in WPMobile.App plugin (<=11.82) exposes password-reset URLs via mail-to-push, risking admin account takeover. Disable mail-to-push until patched. https://radar.offseq.com/threat/cve-2026-94541-cwe-862-missing-authorization-in-amauric-wpmobileapp-android-and-ios-app-builder-544a87f570200da9 #OffSeq #WordPress #CVE202694541 #Infosec", "url": "https://infosec.exchange/users/offseq/statuses/117370848802242230"}, {"timestamp": "2026-10-02T10:30:26.840Z", "date_only": false, "value": "2026-10-02T10:30:26.840866Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwv64ngwj62h", "record": "cve-2026-94541", "field": "creation_timestamp", "uuid": "7206e3da-6e05-4b75-a850-f770a11b2670", "content": "WPMobile.App plugin (<=11.82) hit by CRITICAL vulnerability (CVE-2026-94541): attackers can grab reset URLs & hijack accounts if mail-to-push is on. Disable that feature ASAP. https://radar.offseq.com/threat/cve-2026-94541-cwe-862-missing-authorization-in-amauric-wpmobileapp-android-and-ios-app-b...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mwv64ngwj62h"}, {"timestamp": "2026-10-02T10:44:52.353Z", "date_only": false, "value": "2026-10-02T10:44:52.353633Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3mwv6whjoxb2i", "record": "cve-2026-94541", "field": "creation_timestamp", "uuid": "1d7865b8-cf80-4aca-9577-046dd35680b2", "content": "CVE-2026-94541 scores 9.8 against WPMobile.App through 11.82.\n\u2022 Authorization bypass lets attackers grab password-reset URLs\n\u2022 Requires mail-to-push feature enabled\n\u2022 Allows admin account takeover\n\nhttps://thecircuitry.to/article/critical-cve-2026-94541-in-wpmobileapp-plugin-muqtr232", "url": "https://bsky.app/profile/thecircuitry.to/post/3mwv6whjoxb2i"}, {"timestamp": "2026-10-02T10:46:20.426Z", "date_only": false, "value": "2026-10-02T10:46:20.426698Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwv6z2fams25", "record": "CVE-2026-94541", "field": "creation_timestamp", "uuid": "713ad14e-9ef4-4fdd-a454-10d07764a18d", "content": "\ud83d\udd34 CVE-2026-94541 - Critical (9.8)\n\nThe WPMobile.App \u2013 Android and iOS App Builder plugin for WordPress is vulnerable to authorizat...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-94541/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwv6z2fams25"}, {"timestamp": "2026-10-02T12:07:22.080Z", "date_only": false, "value": "2026-10-02T12:07:22.080286Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwvdjww66x2e", "record": "CVE-2026-94541", "field": "creation_timestamp", "uuid": "f48e6861-2de8-4232-8f03-e82449d7301a", "content": "\ud83d\udea8 CVE-2026-94541 \u2014 CVSS 9.8 CRITICAL\n\nThe WPMobile.App \u2013 Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass i...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-94541\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mwvdjww66x2e"}, {"timestamp": "2026-10-02T12:31:11Z", "date_only": false, "value": "2026-10-02T12:31:11Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-QHJ3-2W8C-62VM", "record": "GHSA-QHJ3-2W8C-62VM", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-02T12:31:11Z", "date_only": false, "value": "2026-10-02T12:31:11Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-QHJ3-2W8C-62VM", "record": "GHSA-QHJ3-2W8C-62VM", "field": "modified"}, {"timestamp": "2026-10-02T18:04:32.134Z", "date_only": false, "value": "2026-10-02T18:04:32.134881Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-94541", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-02T18:04:32.134Z", "date_only": false, "value": "2026-10-02T18:04:32.134881Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94541", "record": "FKIE_CVE-2026-94541", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-02T18:04:42.408Z", "date_only": false, "value": "2026-10-02T18:04:42.408Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-94541", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-02T18:04:42.408Z", "date_only": false, "value": "2026-10-02T18:04:42.408Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-94541", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-02T18:17:07.870Z", "date_only": false, "value": "2026-10-02T18:17:07.870", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94541", "record": "FKIE_CVE-2026-94541", "field": "lastModified"}, {"timestamp": "2026-10-02T21:00:04Z", "date_only": false, "value": "2026-10-02T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/QJcp8mMVwkckmWy2vNERi0JIp0XH67UiGqcKrYMaZc7iixE", "record": "CVE-2026-94541", "field": "creation_timestamp", "uuid": "abc50f40-9e12-428d-a466-c4bdba7fd1c4", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-02T21:00:04Z", "date_only": false, "value": "2026-10-02T21:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/QJcp8mMVwkckmWy2vNERi0JIp0XH67UiGqcKrYMaZc7iixE", "record": "CVE-2026-94541", "field": "creation_timestamp", "uuid": "6cc2bce7-6741-4b42-af38-d021105a5324"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2026-41230", "record": "CNVD-2026-41230", "field": "submitTime"}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": true, "value": "2026-10-16", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2026-41230", "record": "CNVD-2026-41230", "field": "openTime"}], "metrics": {"as_of": "2026-11-02T06:32:20.961Z", "anchors": {"origin": {"timestamp": "2026-10-02T09:25:55.662Z", "date_only": false, "value": "2026-10-02T09:25:55.662Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-94541", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-02T09:25:55.662Z", "date_only": false, "value": "2026-10-02T09:25:55.662Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-94541", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-10-02T21:00:04Z", "date_only": false, "value": "2026-10-02T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/QJcp8mMVwkckmWy2vNERi0JIp0XH67UiGqcKrYMaZc7iixE", "record": "CVE-2026-94541", "field": "creation_timestamp", "uuid": "abc50f40-9e12-428d-a466-c4bdba7fd1c4", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 41648.338, "hours": 11.568982777777778, "days": 0.48204094907407413, "min_seconds": 41648.338, "max_seconds": 41648.338, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-02T09:25:55.662Z", "date_only": false, "value": "2026-10-02T09:25:55.662Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-94541", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-02T21:00:04Z", "date_only": false, "value": "2026-10-02T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/QJcp8mMVwkckmWy2vNERi0JIp0XH67UiGqcKrYMaZc7iixE", "record": "CVE-2026-94541", "field": "creation_timestamp", "uuid": "abc50f40-9e12-428d-a466-c4bdba7fd1c4", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 2667985.299916, "hours": 741.1070277544445, "days": 30.87945948976852, "min_seconds": 2667985.299916, "max_seconds": 2667985.299916, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-02T09:25:55.662Z", "date_only": false, "value": "2026-10-02T09:25:55.662Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-94541", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-02T06:32:20.961Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 2626336.961916, "hours": 729.5380449766667, "days": 30.397418540694446, "min_seconds": 2626336.961916, "max_seconds": 2626336.961916, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-02T21:00:04Z", "date_only": false, "value": "2026-10-02T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/QJcp8mMVwkckmWy2vNERi0JIp0XH67UiGqcKrYMaZc7iixE", "record": "CVE-2026-94541", "field": "creation_timestamp", "uuid": "abc50f40-9e12-428d-a466-c4bdba7fd1c4", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-02T06:32:20.961Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}