What is the CVSS score of CVE-2026-14488?

CVE-2026-14488 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Meta Box AIO are affected by CVE-2026-14488?

Meta Box AIO, a popular WordPress plugin, contains a critical vulnerability (CVE-2026-14488, CVSS 9.1) enabling any unauthenticated attacker to delete arbitrary posts and pages through trivial GET…

How to fix or mitigate CVE-2026-14488?

Within 24 hours: Immediately deactivate the Meta Box AIO plugin or, if the Frontend Submission extension is not required, disable it through plugin settings; implement temporary network-level access controls (firewall rules, WAF) to block requests to frontend submission form endpoints if deactivation is infeasible. Within 7 days: Complete a full inventory of all WordPress installations running Meta Box AIO versions up to and including 3.8.0; review database audit logs and web access logs for evidence of unauthorized content deletion during the exposure period. Within 30 days: Establish daily monitoring of Meta Box AIO vendor channels and GitHub repository for patch availability; develop and test an upgrade plan for immediate deployment upon patch release; evaluate alternative WordPress management plugins if the vendor does not release a patch within 30 days.

Meta Box AIO CVE-2026-14488

EUVD-2026-50274 CRITICAL

Missing Authorization (CWE-862)

2026-07-29 Wordfence

GHSA-gvv9-4pjw-fv88

WordPress Authentication Bypass Meta Box Meta Box Aio

9.1

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated single GET request (AV:N/AC:L/PR:N/UI:N) deletes arbitrary content, giving high integrity and availability impact and no confidentiality exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 10:54 vuln.today

CVE Published

Jul 29, 2026 - 09:31 cve.org

CRITICAL 9.1

DescriptionCVE.org

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handle_request() function routing the mbfs_delete action without any capability or ownership check, and the nonce verification in check_ajax() being gated behind is_ajax() which is false for template_redirect requests, making it bypassable. This makes it possible for unauthenticated attackers to delete arbitrary posts and pages by supplying an attacker-controlled post ID via the rwmb_frontend_field_object_id GET parameter on any page that hosts a frontend submission form regardless of whether allow_delete is enabled.

Articles & Coverage 1

News Critical Arbitrary Content Deletion in WordPress Meta Box AIO Plugin - CVE-2026-14488 Jul 30, 2026

AnalysisAI

Arbitrary post and page deletion in the Meta Box AIO plugin for WordPress (versions up to and including 3.8.0) allows unauthenticated attackers to destroy any content on the site. The MB Frontend Submission extension's template_redirect dispatcher routes the mbfs_delete action without any capability or ownership check, and its nonce protection is unreachable on non-AJAX requests, so any page hosting a frontend submission form becomes a deletion endpoint. No public exploit identified at time of analysis, but the trivial GET-based vector and 9.1 CVSS make this a high-priority integrity/availability threat.

Technical ContextAI

The affected component is the MB Frontend Submission extension bundled into Meta Box AIO (cpe:2.3:a:meta_box:meta_box_aio), a commercial all-in-one package for the widely used Meta Box custom-fields framework on WordPress. The root cause is CWE-862 (Missing Authorization): WordPress fires the template_redirect hook on normal page loads, and the extension's handle_request() function dispatches the mbfs_delete action from that hook without verifying the caller's capabilities or ownership of the target object. Compounding this, the nonce check inside check_ajax() is gated behind is_ajax(), which returns false during a template_redirect page request, so the CSRF/nonce control is silently skipped rather than enforced. The target object is taken directly from the attacker-controlled rwmb_frontend_field_object_id GET parameter, allowing deletion of arbitrary post IDs.

RemediationAI

Upgrade Meta Box AIO to the first release above 3.8.0 that addresses this issue; the vendor changelog at https://metabox.io/plugins/meta-box-aio/changelog/ should be consulted for the exact fixed version, as a released patched version is not independently confirmed from the provided data (do not rely on allow_delete being off, since the flaw bypasses that setting). Until patched, the most effective compensating control is to unpublish or restrict access to any page hosting an MB Frontend Submission form, or temporarily deactivate the MB Frontend Submission extension - the trade-off is loss of frontend content submission functionality. As a stopgap, deploy a WAF/virtual-patch rule (e.g., via Wordfence) to block requests carrying the rwmb_frontend_field_object_id GET parameter combined with the mbfs_delete action on front-end URLs, accepting the risk that legitimate deletion workflows will also be blocked. Refer to the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e9506f84-3d33-48e0-8dce-d517e1a923e4?source=cve for detection signatures.