Meta Box CVE-2026-109700

Exploitation requires an authenticated WordPress account on the target site (CVSS PR:L), so the realistic precondition is a site that permits low-privilege account creation (e.g. open user registration) or an attacker who already holds any valid account. The specific condition from the description is 'incorrectly configured access control security levels' within the Meta Box plugin - i.e. the vulnerable code path fails to verify that the requesting user is authorized for the targeted custom-field/meta data. Limiting factors: a valid account is mandatory (not unauthenticated), impact is confined to confidentiality (C:H, no integrity or availability impact), and only sites running Meta Box at or below version 5.15.2 are affected. No user interaction is required (UI:N).

This is a Missing Authorization flaw (CWE-862) in the Meta Box WordPress Custom Fields Framework, scored CVSS 6.5 (Medium). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates network-reachable, low-complexity exploitation requiring low-level authentication (PR:L - e.g. a subscriber/contributor-tier account), no user interaction, with high confidentiality impact but no integrity or availability impact - consistent with unauthorized read access to data that should be access-controlled. On real-world prioritization signals, this is a moderate rather than urgent issue: there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active or automatable exploitation. No EPSS score, SSVC decision, or POC indicator was provided in the input, so exploitation probability cannot be quantified - this absence is a gap, not a low score. The requirement for an authenticated account (PR:L) meaningfully limits mass exploitation compared to a fully unauthenticated flaw. The CVSS vector and the description (broken/incorrectly configured access control) are internally consistent. One labeling nuance: the input Tags call this 'Authentication Bypass', whereas the description and CWE-862 describe missing authorization / broken access control - these are distinct weakness classes; verify framing before reporting to stakeholders.

An attacker who holds a low-privilege WordPress account (such as a self-registered subscriber on a site with open registration) sends a crafted authenticated request to a Meta Box endpoint that fails to enforce proper authorization checks. Because the access-control check is missing or misconfigured, the attacker reads custom-field or meta data they should not be permitted to access, disclosing sensitive information. No public exploit code was identified at time of analysis, and the attack requires a valid (if low-privileged) account.