EUVD-2026-50274
GHSA-gvv9-4pjw-fv88
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Unauthenticated single GET request (AV:N/AC:L/PR:N/UI:N) deletes arbitrary content, giving high integrity and availability impact and no confidentiality exposure.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handle_request() function routing the mbfs_delete action without any capability or ownership check, and the nonce verification in check_ajax() being gated behind is_ajax() which is false for template_redirect requests, making it bypassable. This makes it possible for unauthenticated attackers to delete arbitrary posts and pages by supplying an attacker-controlled post ID via the rwmb_frontend_field_object_id GET parameter on any page that hosts a frontend submission form regardless of whether allow_delete is enabled.
Articles & Coverage 1
AnalysisAI
Arbitrary post and page deletion in the Meta Box AIO plugin for WordPress (versions up to and including 3.8.0) allows unauthenticated attackers to destroy any content on the site. The MB Frontend Submission extension's template_redirect dispatcher routes the mbfs_delete action without any capability or ownership check, and its nonce protection is unreachable on non-AJAX requests, so any page hosting a frontend submission form becomes a deletion endpoint. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that the target site runs Meta Box AIO ≤ 3.8.0 and publishes at least one page that hosts an MB Frontend Submission form; the attacker sends the mbfs_delete action with an arbitrary target post ID in the rwmb_frontend_field_object_id GET parameter to that page. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H is internally consistent with the description: network-reachable, low complexity, no privileges, no user interaction, with high integrity and availability impact (content destruction) and no confidentiality loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker locates a public WordPress page that renders a Meta Box frontend submission form, then simply requests that page with ?mbfs_delete... and rwmb_frontend_field_object_id set to a target post ID such as the site's homepage or a key article. … |
| Remediation | Upgrade Meta Box AIO to the first release above 3.8.0 that addresses this issue; the vendor changelog at https://metabox.io/plugins/meta-box-aio/changelog/ should be consulted for the exact fixed version, as a released patched version is not independently confirmed from the provided data (do not rely on allow_delete being off, since the flaw bypasses that setting). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Immediately deactivate the Meta Box AIO plugin or, if the Frontend Submission extension is not required, disable it through plugin settings; implement temporary network-level access controls (firewall rules, WAF) to block requests to frontend submission form endpoints if deactivation is infeasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today