Meta Box
Monthly
Unauthenticated privilege escalation to WordPress Administrator in the Meta Box AIO plugin (versions up to and including 3.11.0) - and in the standalone Meta Box Frontend Submission (≤4.5.6) and Meta Box User Profile (≤3.11.0) plugins - lets remote attackers rewrite the post_content of any page with an attacker-supplied shortcode and then create a new administrative account. The exploit chains three defects: populate_via_query_string() in mb-frontend-submission unconditionally overrides the form's target object_id from the rwmb_frontend_field_object_id GET parameter, Form::process() omits the user_can_edit() check that render() enforces, and mb-user-profile trusts the role and auto_login attributes of an injected [mb_user_profile_register] shortcode without validating the requested role. The flaw is network-reachable with PR:N/UI:N per the assessed CVSS 3.1 vector (9.8), so no authentication, user interaction, or prior privileges are required; Wordfence disclosed the issue, publicly available exploit code has not been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation. The practical exposure limiter is deployment-specific: the site must expose a Meta Box frontend-submission form and must process the mb-user-profile registration component for the escalation to complete.
Arbitrary post and page deletion in the Meta Box AIO plugin for WordPress (versions up to and including 3.8.0) allows unauthenticated attackers to destroy any content on the site. The MB Frontend Submission extension's template_redirect dispatcher routes the mbfs_delete action without any capability or ownership check, and its nonce protection is unreachable on non-AJAX requests, so any page hosting a frontend submission form becomes a deletion endpoint. No public exploit identified at time of analysis, but the trivial GET-based vector and 9.1 CVSS make this a high-priority integrity/availability threat.
Meta Box WordPress plugin before 5.13.1 allows any user holding a Contributor-level role (or equivalent low-privilege account) to permanently delete arbitrary media attachments owned by other users, including administrators, due to a missing authorization check on the deletion endpoint. The root cause is CWE-862: the plugin performs the deletion operation without verifying whether the requesting user has ownership or administrative rights over the target attachment. Publicly available exploit code exists (sourced from WPScan), and while EPSS sits at a low 0.17% (6th percentile), the low attack complexity and wide availability of Contributor accounts on multi-author WordPress sites make this a realistic insider or compromised-account threat.
The Meta Box WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's posts. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Meta Box - WordPress Custom Fields Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta values displayed through the plugin's shortcode in all versions. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated privilege escalation to WordPress Administrator in the Meta Box AIO plugin (versions up to and including 3.11.0) - and in the standalone Meta Box Frontend Submission (≤4.5.6) and Meta Box User Profile (≤3.11.0) plugins - lets remote attackers rewrite the post_content of any page with an attacker-supplied shortcode and then create a new administrative account. The exploit chains three defects: populate_via_query_string() in mb-frontend-submission unconditionally overrides the form's target object_id from the rwmb_frontend_field_object_id GET parameter, Form::process() omits the user_can_edit() check that render() enforces, and mb-user-profile trusts the role and auto_login attributes of an injected [mb_user_profile_register] shortcode without validating the requested role. The flaw is network-reachable with PR:N/UI:N per the assessed CVSS 3.1 vector (9.8), so no authentication, user interaction, or prior privileges are required; Wordfence disclosed the issue, publicly available exploit code has not been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation. The practical exposure limiter is deployment-specific: the site must expose a Meta Box frontend-submission form and must process the mb-user-profile registration component for the escalation to complete.
Arbitrary post and page deletion in the Meta Box AIO plugin for WordPress (versions up to and including 3.8.0) allows unauthenticated attackers to destroy any content on the site. The MB Frontend Submission extension's template_redirect dispatcher routes the mbfs_delete action without any capability or ownership check, and its nonce protection is unreachable on non-AJAX requests, so any page hosting a frontend submission form becomes a deletion endpoint. No public exploit identified at time of analysis, but the trivial GET-based vector and 9.1 CVSS make this a high-priority integrity/availability threat.
Meta Box WordPress plugin before 5.13.1 allows any user holding a Contributor-level role (or equivalent low-privilege account) to permanently delete arbitrary media attachments owned by other users, including administrators, due to a missing authorization check on the deletion endpoint. The root cause is CWE-862: the plugin performs the deletion operation without verifying whether the requesting user has ownership or administrative rights over the target attachment. Publicly available exploit code exists (sourced from WPScan), and while EPSS sits at a low 0.17% (6th percentile), the low attack complexity and wide availability of Contributor accounts on multi-author WordPress sites make this a realistic insider or compromised-account threat.
The Meta Box WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's posts. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Meta Box - WordPress Custom Fields Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta values displayed through the plugin's shortcode in all versions. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.