Meta Box AIO Plugin Vulnerable to Unauthenticated Post Deletion via CVE-2026-14488

A critical Missing Authorization vulnerability, tracked as CVE-2026-14488, has been identified in the Meta Box AIO plugin for WordPress, specifically within its MB Frontend Submission extension, affecting all versions up to and including 3.8.0. This flaw allows unauthenticated attackers to delete any post or page on a vulnerable WordPress site. The vulnerability arises because the plugin's handle_request() function, when routed through the template_redirect dispatcher, processes the mbfs_delete action without proper capability or ownership checks. Furthermore, nonce verification, typically handled by check_ajax(), is bypassed because is_ajax() returns false for template_redirect requests. This oversight permits attackers to specify an arbitrary post ID via the rwmb_frontend_field_object_id GET parameter on any page hosting a frontend submission form, regardless of whether the allow_delete option is enabled, leading to unauthorized data destruction.

Attack Chain

1. An unauthenticated attacker identifies a WordPress site running the Meta Box AIO plugin with the MB Frontend Submission extension, version 3.8.0 or older.
2. The attacker browses the target WordPress site to locate any public-facing page that hosts a frontend submission form.
3. The attacker crafts a malicious HTTP GET request targeting this identified page.
4. The request includes the rwmb_frontend_field_object_id GET parameter, supplying the ID of an arbitrary post or page the attacker intends to delete. For example, GET /submission-page/?rwmb_frontend_field_object_id=123.
5. The WordPress application processes the incoming request, and the vulnerable template_redirect dispatcher invokes the plugin's handle_request() function.
6. The handle_request() function, due to the missing authorization checks and bypassed nonce verification, proceeds to route and execute the mbfs_delete action.
7. The post or page corresponding to the ID provided in the rwmb_frontend_field_object_id parameter is then deleted from the WordPress site's database.

Impact

The successful exploitation of CVE-2026-14488 results in significant data loss and service disruption for affected WordPress sites. Unauthenticated attackers can delete any posts, pages, or custom post types, leading to the removal of critical content, defacement, or rendering the website unusable. This can severely damage an organization's reputation, cause financial losses due to lost data or operational downtime, and necessitate extensive recovery efforts. The CVSS v3.1 Base Score for this vulnerability is 9.1, indicating critical severity and ease of exploitation.

Recommendation

• Patch CVE-2026-14488 by updating the Meta Box AIO plugin to a version greater than 3.8.0 immediately.
• Deploy the Sigma rule "Detect CVE-2026-14488 Exploitation - Meta Box AIO Plugin Missing Authorization" to your SIEM for web server logs.
• Review web server access logs for cs-uri-query containing rwmb_frontend_field_object_id= for suspicious activity prior to patching.