EUVD-2026-51935
GHSA-vpwf-36p2-3fwr
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L
Description explicitly identifies Contributor-level access (PR:L, not PR:H); no confidentiality impact; integrity is fully compromised via unrestricted deletion.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users.
AnalysisAI
Meta Box WordPress plugin before 5.13.1 allows any user holding a Contributor-level role (or equivalent low-privilege account) to permanently delete arbitrary media attachments owned by other users, including administrators, due to a missing authorization check on the deletion endpoint. The root cause is CWE-862: the plugin performs the deletion operation without verifying whether the requesting user has ownership or administrative rights over the target attachment. Publicly available exploit code exists (sourced from WPScan), and while EPSS sits at a low 0.17% (6th percentile), the low attack complexity and wide availability of Contributor accounts on multi-author WordPress sites make this a realistic insider or compromised-account threat.
Technical ContextAI
Meta Box is a widely-used WordPress plugin for managing custom meta fields and meta boxes across post types. WordPress enforces a role and capability system (Subscriber, Contributor, Author, Editor, Administrator) where Contributors may create and edit their own posts but are explicitly denied the capability to delete or manage content belonging to others. The vulnerability arises because the plugin exposes an attachment deletion code path (CWE-862: Missing Authorization) that does not call the appropriate WordPress capability checks - such as delete_post or verifying post ownership - before executing the deletion. The affected CPE is cpe:2.3:a:unknown:meta_box:*:*:*:*:*:*:*:* covering all versions prior to 5.13.1. Any installation where the plugin is active and user registration is enabled is potentially exposed.
RemediationAI
Update the Meta Box plugin to version 5.13.1 or later, which introduces the missing authorization check on attachment deletion. The patch is confirmed available from the vendor per WPScan (https://wpscan.com/vulnerability/a101136d-606f-4529-ae78-a4fff7724e2c/) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-15248). If immediate patching is not possible, a specific compensating control is to disable user registration or restrict the Contributor role on the WordPress site, which removes the primary attack surface (trade-off: reduces community contribution capabilities). Site administrators can also audit active user accounts for unexpected Contributor-level registrations and restrict file deletion operations at the application firewall layer by blocking suspicious deletion endpoint requests. Note that the media deletion is permanent and irreversible once triggered, so backup integrity should be verified prior to remediation to assess whether any deletions have already occurred.
The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=r
Arbitrary post and page deletion in the Meta Box AIO plugin for WordPress (versions up to and including 3.8.0) allows un
The Meta Box WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access arbitra
The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders. Rated high severity
The Meta Box - WordPress Custom Fields Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via c
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today