What is the CVSS score of CVE-2026-3173?

CVE-2026-3173 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Meta Field Block CVE-2026-3173

EUVD-2026-32722 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-28 security@wordfence.com

GHSA-2xg8-969f-84gv

Information Disclosure WordPress Authentication Bypass

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 06:31 vuln.today

CVE Published

May 28, 2026 - 06:16 nvd

MEDIUM 6.5

DescriptionCVE.org

The Meta Field Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.5.1. This is due to the plugin allowing users to specify arbitrary object IDs and object types via block attributes without validating whether the authenticated user has permission to access the requested object's metadata. This makes it possible for authenticated attackers, with Contributor-level access and above, to read arbitrary user meta, post meta, and term meta data from any object in the database. On sites using plugins that store sensitive data in meta fields (e.g., WooCommerce billing/shipping information), this could lead to the exposure of Personally Identifiable Information (PII) including names, email addresses, phone numbers, and physical addresses.

AnalysisAI

Insecure Direct Object Reference in the Meta Field Block WordPress plugin (all versions through 1.5.1) allows authenticated attackers with Contributor-level access to read arbitrary user meta, post meta, and term meta data from any object in the database by supplying unchecked object IDs and types via block attributes. The CVSS vector (AV:N/AC:L/PR:L/UI:N/C:H) confirms this is remotely exploitable with low privilege and no user interaction, with a full confidentiality impact on metadata. Risk is materially elevated on sites running WooCommerce or similar plugins that persist PII - names, billing addresses, phone numbers, emails - in meta fields. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

The Meta Field Block plugin (WordPress.org slug: display-a-meta-field-as-block) renders arbitrary WordPress metadata values as Gutenberg blocks. The root cause is CWE-639 (Authorization Through User-Controlled Key), a class of Insecure Direct Object Reference where an application uses an attacker-supplied identifier to look up a protected resource without first verifying the caller's authorization. Specifically, the block accepts object_id and object_type attributes - which determine what WordPress meta record is fetched - directly from user-supplied block markup without performing a capability or ownership check. The vulnerable logic is identified at lines 206 and 328 of meta-field-block.php in the plugin's trunk. WordPress's meta API (get_user_meta, get_post_meta, get_term_meta) returns data for any valid ID when called without permission gating, so the flaw is architectural rather than a simple missing nonce: the plugin never asks 'does this user have the right to view this object's metadata?' before returning it.

RemediationAI

Upstream fix available via WordPress plugin repository changeset 3472303 (https://plugins.trac.wordpress.org/changeset/3472303/), which modifies the affected code paths at meta-field-block.php lines 206 and 328 to enforce authorization checks before returning metadata. Site administrators should update the Meta Field Block plugin to the version corresponding to or superseding this changeset - the exact fixed version number is not confirmed in the available input data beyond the changeset reference; verify the current patched release in the WordPress plugin directory or the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/247df9e2-0a63-49ad-86fa-cb4c6e62c4cf. If immediate patching is not possible, a compensating control is to remove Contributor-level accounts or restrict the ability of Contributors to publish blocks on the site, which eliminates the PR:L attack path. Disabling the Meta Field Block plugin entirely is a more drastic but complete workaround with the trade-off of losing any frontend meta field display functionality.