Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion
Priority LOW 39CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_delete_file' function in all versions up to, and including, 5.11.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02671 85th percentileScored 2026-11-07
Fix Fixed wpmetabox/meta-box (Packagist): 5.11.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| metabox | Meta Box | up to 5.11.1 | — | No fix listed | CNA |
| — | wpmetabox/meta-box (Packagist) | before 5.11.2 | 5.11.2 | Patch available | GHSA-m4q3-832v-44j6 |
- Meta Box Vendormetabox Affected up to 5.11.1 Fixed in — No fix listed CNA
- wpmetabox/meta-box (Packagist) Vendor— Affected before 5.11.2 Fixed in 5.11.2 Patch available GHSA-m4q3-832v-44j6
Remediation
- Fix · GHSA-m4q3-832v-44j6 wpmetabox/meta-box (Packagist) Fixed in 5.11.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-14675
- 2026-10-03 Alias added: GHSA-m4q3-832v-44j6
References
Other 7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/036467de-95bb-4bfd-9522-df8dc17f3102?source=cve
- https://plugins.trac.wordpress.org/changeset/3475210/meta-box#file3
- https://plugins.trac.wordpress.org/browser/meta-box/tags/5.11.0/inc/fields/file.php#L30
- https://plugins.trac.wordpress.org/browser/meta-box/tags/5.11.0/inc/fields/file.php#L54
- https://github.com/wpmetabox/meta-box/pull/1654
- https://github.com/wpmetabox/meta-box/commit/08c6511607b9cc9fe8d0de7a7e91c9d5d415f831
- https://github.com/wpmetabox/meta-box
More metabox vulnerabilities
- TI-2024-01119 Meta Box < 5.9.4 - Contributor+ Arbitrary Posts' Custom Field Disclosure CVSS 3.1MEDIUM 4.3
- TI-2026-11316 Improper privilege management in metabox Meta Box Frontend Submission CVSS 3.1CRITICAL 9.8
- TI-2026-12241 Missing authorization in metabox Meta Box AIO CVSS 3.1CRITICAL 9.1
- TI-2019-11000 The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders. CVSS 3.0HIGH 7.5
- TI-2019-10999 The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the… CVSS 3.0MEDIUM 6.5
- TI-2023-05981 Meta Box – WordPress Custom Fields Framework <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 3.1MEDIUM 6.4
Sources
- CVE-2025-14675 · CVE Program
- CVE-2025-14675 · NVD
- FIRST EPSS
- GHSA-m4q3-832v-44j6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences