Read the docs
TI-2026-11316 Aliases CVE-2026-13355GHSA-q84q-9hmp-p3qm

Improper privilege management in metabox Meta Box Frontend Submission

Priority MEDIUM 50CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populate_via_query_string() function in the mb-frontend-submission component unconditionally overrides the form's target object_id from the GET parameter 'rwmb_frontend_field_object_id' without any authorization check, and Form::process() lacks the user_can_edit() check present in render(), allowing unauthenticated attackers to overwrite the post_content of any page with an arbitrary shortcode via wp_update_post(); the mb-user-profile component then directly trusts the 'role' and 'auto_login' shortcode attributes in the injected [mb_user_profile_register] shortcode with no role validation. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator. The standalone plugins Meta Box Frontend Submission (in versions up to 4.5.6) and Meta Box User Profile (versions up to 3.11.0) are also affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00602 49th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
metaboxMeta Box Frontend Submissionup to 4.5.6—No fix listedCNA
  • Meta Box Frontend Submission Vendormetabox Affected up to 4.5.6 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-13355
  2. 2026-10-03 Alias added: GHSA-q84q-9hmp-p3qm

References

Other 3

  • TI-2024-01119 Meta Box < 5.9.4 - Contributor+ Arbitrary Posts' Custom Field Disclosure CVSS 3.1MEDIUM 4.3
  • TI-2026-12241 Missing authorization in metabox Meta Box AIO CVSS 3.1CRITICAL 9.1
  • TI-2025-13408 Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion CVSS 3.1HIGH 7.2
  • TI-2019-11000 The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders. CVSS 3.0HIGH 7.5
  • TI-2019-10999 The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the… CVSS 3.0MEDIUM 6.5
  • TI-2023-05981 Meta Box – WordPress Custom Fields Framework <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 3.1MEDIUM 6.4
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences