Meta Box AIO CVE-2026-39761

The target must be a WordPress installation with the Meta Box AIO plugin (eLightUp) at version 3.7.1 or earlier installed and active; the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote unauthenticated exploitation against a default installation with no user interaction or credentials required. The one-line description names no specific feature, configuration setting, or deployment mode as a precondition, so the exact triggering endpoint/mechanism is not disclosed in the available data and should be confirmed against the Patchstack advisory. The only concrete limiting factors are the affected-version ceiling (<= 3.7.1) and the requirement that the vulnerable plugin be present and enabled - there is no authentication, interaction, or non-default-configuration barrier per the CVSS vector.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8 Critical) describes a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity, and availability impact - consistent with the 'Unauthenticated Privilege Escalation' summary and CWE-266 (Incorrect Privilege Assignment). On raw CVSS this is a top-priority issue. However, the corroborating exploitation signals that would confirm urgency are absent: no EPSS score was supplied, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced - so this is currently a high-CVSS finding without evidence of real-world exploitation. The single source is a Patchstack database entry, which is a credible WordPress-vulnerability authority but constitutes one source rather than vendor or NVD confirmation. Net: treat as a genuine high-priority patch item for sites running Meta Box AIO because unauthenticated privilege escalation is directly weaponizable once details/PoC emerge, but note that no exploitation-probability or active-exploitation data is available to distinguish widespread from merely theoretical risk. Key missing data: EPSS probability, PoC status, confirmed fixed version, and the specific vulnerable mechanism (the description is a one-line summary with no technical detail).

A remote, unauthenticated attacker sends crafted requests to a WordPress site running the Meta Box AIO plugin (version 3.7.1 or earlier), abusing an incorrect privilege-assignment flaw to elevate their effective privileges to those of an administrative or higher-privileged account. With AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing are required, allowing straightforward takeover of site functions. No public exploit code is referenced at this time, so exploitation would require independent development.