Meta Box AIO CVE-2026-13355

Exploitation requires the target WordPress site to be running a vulnerable Meta Box build - Meta Box AIO ≤3.11.0, the standalone Meta Box Frontend Submission ≤4.5.6, or Meta Box User Profile ≤3.11.0 - AND to have a Meta Box frontend-submission form reachable so the attacker's request can hit Form::process(); the mb-user-profile component must also process the injected [mb_user_profile_register] shortcode for the role escalation to complete. No authentication, user interaction, or special privileges are needed (PR:N/UI:N), and it works against network-facing default form deployments. The main practical limiter is that the site must actually expose a Meta Box frontend submission form and use the User Profile registration component; sites with the plugins installed but no frontend form are less directly exposed.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes fully remote, unauthenticated, low-complexity exploitation with no user interaction, and the C:H/I:H/A:H impact is well-justified because the end state is a self-created Administrator account - total site compromise. The vulnerability chain is clearly and specifically documented by Wordfence (an authoritative WordPress-security source), which raises confidence that the described mechanism is real and reliable rather than theoretical: an unauthenticated attacker abuses populate_via_query_string()'s unchecked 'rwmb_frontend_field_object_id' GET parameter plus a missing user_can_edit() check in Form::process() to overwrite arbitrary page post_content with an [mb_user_profile_register] shortcode whose 'role' and 'auto_login' attributes are trusted without validation. No EPSS score, CISA KEV entry, or public POC was provided in the input; per precision rules this is 'no public exploit identified at time of analysis.' The absence of KEV/EPSS/POC signals means widespread active exploitation is not yet confirmed, but the low technical bar, unauthenticated network vector, and Administrator-level outcome make this the kind of WordPress flaw that is typically weaponized quickly once details circulate - it should be patched urgently regardless of the missing exploitation telemetry.

An unauthenticated attacker sends a crafted request to a site running a Meta Box frontend-submission form, supplying 'rwmb_frontend_field_object_id' to retarget the form at an existing published page and submitting content that injects an [mb_user_profile_register] shortcode with role=administrator and auto_login enabled. Because Form::process() omits the user_can_edit() authorization check, the attacker's payload overwrites the page's post_content, and when the shortcode renders it registers (and auto-logs-in) an attacker-controlled Administrator. No public proof-of-concept was provided in the source data, but the low attack complexity and no-authentication vector make reliable exploitation straightforward.